reusable-vendor-vulnerability-scanner.yml

# %CopyrightBegin%
#
# SPDX-License-Identifier: Apache-2.0
#
# Copyright Ericsson AB 2024-2026. All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# %CopyrightEnd%

name: Vendor Vulnerability Scanning
run-name: "[${{ inputs.version }}] Vendor Vulnerability Scanning"

# 'inputs' must be repeated twice for the different use cases.
# there is no current way to share 'inputs' for workflow dispatch
# and call.
#
# version: reference branch to checkout and analyse for CVE.
#
# fail_if_cve: makes the job fail if a CVE is found.
#        This is 'true' when analysing PRs, as we prefer a failure to detect that the PR
#        introduces a vulnerability.
#

on:
  workflow_dispatch:
    inputs:
      # this option is needed for scheduled scans. on pull requests (`main.yaml`)
      # the PR already contains a branch on which to run and there is a known
      # base_ref. on scheduled runs of this job, `base_ref` does not exist and
      # we need to specify which repo branch to checkout.
      checkout:
        description: 'Checkout branch in version?'
        required: false
        default: false
        type: boolean
      version:
        description: 'Reference branch to fetch OpenVEX statements'
        required: true
        type: 'string'
      fail_if_cve:
        description: 'Fail if CVE is found and create issue'
        required: true
        type: boolean
  workflow_call:
    secrets:
      # these secrets are required when doing workflow calls, e.g., main.yml
      # calling this workflow directly. this is because if-condition at the step
      # level are evaluated before the secrets are injected.
      ERLANG_VENDOR_SCANNER_APP_ID:
        required: false
      ERLANG_VENDOR_SCANNER_BOT_PRIVATE_KEY:
        required: false
    inputs:
      # this option is needed for scheduled scans. on pull requests (`main.yaml`)
      # the PR already contains a branch on which to run and there is a known
      # base_ref. on scheduled runs of this job, `base_ref` does not exist and
      # we need to specify which repo branch to checkout.
      checkout:
        description: 'Checkout branch in version?'
        required: false
        default: false
        type: boolean
      version:
        description: 'Reference branch to fetch OpenVEX statements'
        required: true
        default: 'master'
        type: 'string'
      fail_if_cve:
        description: 'Fail if CVE is found and create issue'
        required: true
        default: false
        type: boolean

permissions:
  contents: read # needed for checkout
  actions: read

env:
  VERSION: ${{ inputs.version }}

jobs:
  modified-vendor-files:
    name: Check if vendor files changed
    runs-on: ubuntu-latest
    permissions:
      contents: read   # actions/checkout (ref: inputs.version or default branch)
      actions:  write  # use inside the otp-compliance.es
      issues:   write  # otp-compliance.es sbom osv-scan (creates GitHub issues when CVEs are found)


    # this condition is necessary because github.base_ref only exists for pull_requests
    if: ${{ github.event_name == 'pull_request' }}
    outputs:
      vendor-files: ${{ steps.vendor-files.outputs.MODIFIED_FILES != '0' }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Get modified vendor files
        id: vendor-files
        env:
          GH_BASE_REF: ${{ github.base_ref }}
        run: |
          echo "MODIFIED_FILES=$(git diff --name-only origin/${GH_BASE_REF} HEAD | grep 'vendor\.info$' | wc -l || 1)" >> $GITHUB_OUTPUT

  analysis-vendor-dependencies:
    name: "Vulnerability Scanning of Vendor Dependencies"
    # This job always fetches otp-compliance escript from `master`.
    # internally, the job downloads OpenVEX statements from `vex` folder.
    # the main reason is that maint-25, maint-26, etc do not have this file
    # committed into them. thus, a workflow_dispatch or workflow_call would
    # not work, and we would not be able to analyse vendor dependecies there.
    runs-on: ubuntu-latest
    needs: modified-vendor-files
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    permissions:
      actions: read
    if: ${{ !cancelled() && (needs.modified-vendor-files.result == 'success' || needs.modified-vendor-files.result == 'skipped') }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
        with:
          ref: ${{ inputs.checkout && inputs.version || ''}} # '' = default branch
          persist-credentials: false

      - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # ratchet:erlef/setup-beam@v1.20.4
        with:
          otp-version: '28'

      - name: Set flag if it is not a forked PR
        run: echo "IS_NOT_FORKED_PR=$([[ -n '${{ secrets.ERLANG_VENDOR_SCANNER_APP_ID }}' && -n '${{ secrets.ERLANG_VENDOR_SCANNER_BOT_PRIVATE_KEY }}' ]] && echo true || echo false)" >> $GITHUB_ENV


      # Conditionally generate GitHub App token if secrets are available
      # this step will only work for scheduled and workflow dispatch jobs,
      # so we need to use the condition below for PRs based on a fork
      - name: "Generate GitHub App Token (if secrets exist)"
        if: ${{ env.IS_NOT_FORKED_PR == 'true' }}
        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # ratchet:actions/create-github-app-token@v2.2.1
        id: app-token
        with:
          app-id: ${{ secrets.ERLANG_VENDOR_SCANNER_APP_ID }}
          private-key: ${{ secrets.ERLANG_VENDOR_SCANNER_BOT_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: otp
          permission-issues: write

      # PRs comming from a fork can use their own GH_TOKEN instead.
      # this is for security reasons that forked PRs cannot work with Github App tokens
      # generated by Erlang/OTP, as that could leak secrets.
      - name: "Set GH_TOKEN for steps"
        env:
          STEPS_APP_TOKEN_OUTPUTS_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          if [ -n "${STEPS_APP_TOKEN_OUTPUTS_TOKEN}" ]; then
            echo "Using GitHub App Token"
            echo "GH_TOKEN=${STEPS_APP_TOKEN_OUTPUTS_TOKEN}" >> $GITHUB_ENV
          else
            echo "Using default GITHUB_TOKEN"
            echo "GH_TOKEN=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV
          fi

      - name: 'Analysis of dependencies from OpenVEX in ${{ inputs.version }}'
        env:
          STEPS_APP_TOKEN_OUTPUTS_TOKEN: ${{ steps.app-token.outputs.token }}
          INPUTS_VERSION: ${{ inputs.version }}
        run: |
          curl -L \
               -H "Accept: application/vnd.github+json" \
               -H "Authorization: Bearer ${GH_TOKEN}" \
               -H "X-GitHub-Api-Version: 2022-11-28" \
               https://api.github.com/repos/erlang/otp/contents/.github/scripts/otp-compliance.es \
               | jq -r '.content' | base64 -d > otp-compliance.es
          chmod +x otp-compliance.es
          cp otp-compliance.es /home/runner/work/otp/otp/.github/scripts/otp-compliance.es
          cd /home/runner/work/otp/otp && \
          GH_TOKEN="${STEPS_APP_TOKEN_OUTPUTS_TOKEN}" .github/scripts/otp-compliance.es sbom osv-scan \
               --version "${INPUTS_VERSION}" \
               --fail_if_cve ${{ inputs.fail_if_cve }}