visual-search-qa-scans.yml

---
# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
# SPDX-License-Identifier: Apache-2.0

name: "[Visual Search and QA] SDLe Scans - Scan Trivy Bandit Virus"
run-name: "[Visual Search and QA] SDLe Scans - Scan Trivy Bandit Virus"


# Only run at most 1 workflow concurrently per PR, unlimited for branches
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.sha }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

on:
  workflow_call:
  workflow_dispatch:
  schedule:
    - cron: "0 2 * * 0"  # 2 a.m. on Sunday

jobs:   
  trivy-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
        with:
          persist-credentials: false

      - name: Build Docker images
        run: |
          ls
          cd metro-ai-suite
          docker build -t visual-search-qa-app:latest -f visual-search-question-and-answering/src/Dockerfile .
          
      - name: Verify Docker image
        run: |
          echo "=== Built Docker Image ==="
          docker images
          ls
          echo "=== Image Build Verification Complete ==="
      - name: Run Trivy Filesystem Scan
        uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
        id: trivy-fs
        with:
          scan_type: "fs"  
          scan-scope: "all"  
          severity: "HIGH,CRITICAL" 
          format: "json"
          scan_target: "metro-ai-suite/visual-search-question-and-answering/"
          report_suffix: "-fs-vsqa-CT7"

      - name: Run trivy Scan -vsqa (HTML Report)
        uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
        id: vsqa-visual-html
        with:
          scan_type: "image"  
          scan-scope: "all"
          scan_target: "visual-search-qa-app:latest"  
          severity: "HIGH,CRITICAL"
          format: "table"
          report_suffix: "-image-vsqa-visual-html-CT248"
          generate_sbom: "false"
          
      - name: Run trivy Scan - vsqa (SPDX SBOM)
        uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
        id: vsqa-visual-spdx
        with:
          scan_type: "image"  
          scan-scope: "all"
          scan_target: "visual-search-qa-app:latest"  
          severity: "HIGH,CRITICAL"  
          format: "spdx-json"
          scanners: "vuln"
          report_suffix: "-image-vsqa-visual-spdx-CT248"
          generate_sbom: "false"

      - name: Scan Dockerfile with Trivy
        uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
        with:
          scan_type: "config"
          scan_target: "metro-ai-suite/visual-search-question-and-answering/src/"
          severity: "HIGH,CRITICAL"
          format: "json"
          misconfig_scanners: "dockerfile"
          report_suffix: "-config-vsqa-CT222"

      - name: Upload Report
        uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
        with:
          name: trivy-report-vsqa
          path: security-results/trivy*

  bandit-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
      
      - name: Run Bandit Scan
        uses: open-edge-platform/orch-ci/.github/actions/security/bandit@27276444a9bcf247a27369406686b689933bd1ff
        id: bandit
        with:
          scan-scope: "all"  
          output-format: "txt" 
          fail-on-findings: "false"
          paths: "metro-ai-suite/visual-search-question-and-answering"
          report_suffix: "-bandit-visual-search-qa-CT161"
          
      - name: Upload Report
        uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
        with:
          name: bandit-report
          path: security-results/bandit*
        

  clamav-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
      
      - name: Run ClamAV Scan
        uses: open-edge-platform/orch-ci/.github/actions/security/clamav@27276444a9bcf247a27369406686b689933bd1ff
        id: clamav
        with:
          scan-scope: "all"  
          output-format: "txt" 
          fail-on-findings: "false"
          paths: "metro-ai-suite/visual-search-question-and-answering"
          exclude_dirs: ".git,tests,docs,.pytest_cache,__pycache__,.venv"
          
      - name: Upload Report
        uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
        with:
          name: clamav-report
          path: security-results/clamav*

  coverity-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:        
      - name: Check out edge-ai-suites repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false   

      - name: Build with Coverity Analysis
        run: |
          wget --quiet https://scan.coverity.com/download/linux64 \
            --post-data "token=${{ secrets.VQA_COVERITY_TOKEN }}&project=${{ secrets.VQA_COVERITY_PROJECT }}" \
            -O coverity_tool.tgz
          mkdir -p cov-analysis
          tar xzf coverity_tool.tgz --strip-components=1 -C cov-analysis
          COV_PATH="$(pwd)/cov-analysis/bin"
          export PATH="$COV_PATH:$PATH"
          ls
          cd metro-ai-suite/visual-search-question-and-answering/src
          coverity capture --dir cov-int --project-dir ./
          
      - name: Create tarball for upload
        run: |
          cd metro-ai-suite/visual-search-question-and-answering/src
          tar -czvf coverity_output.tgz -C . cov-int
          # Verify tarball contents
          echo "=== Tarball Contents ==="
          tar tzvf coverity_output.tgz
          echo "=== head ==="
          tar -tzvf coverity_output.tgz | head
          
      - name: Upload to Coverity Scan
        run: |
          cd metro-ai-suite/visual-search-question-and-answering/src
          curl --form token=${{ secrets.VQA_COVERITY_TOKEN }} \
               --form email=${{ secrets.VQA_COVERITY_EMAIL }} \
               --form file=@coverity_output.tgz \
               --form version="`date +%Y%m%d%H%M%S`" \
               --form description="GitHub Action upload" \
               https://scan.coverity.com/builds?project=${{ secrets.VQA_COVERITY_PROJECT }}