spineapp_pull_request.yaml

name: "[industrial-edge-insights-vision] PR workflow"
run-name: "[industrial-edge-insights-vision] PR  workflow (by @${{ github.actor }} via ${{ github.event_name }})"
on:
  push:
    branches:
      - 'main'
    paths:
      - 'manufacturing-ai-suite/industrial-edge-insights-vision/**'
  pull_request:
    paths:
      - 'manufacturing-ai-suite/industrial-edge-insights-vision/**'
  
  workflow_dispatch:    
      
  workflow_call:
permissions: {}

jobs:
  
          
  virus-scan:
    name: Run Virus Scan
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
    - name: Check out edge-ai-suites repository
      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
      with:
        persist-credentials: false
        path: edge-ai-suites-repo
    - name: Run Virus Scan
      run: |
        mkdir -p reports
        docker pull clamav/clamav
        echo "### Virus Scan Results" >> $GITHUB_STEP_SUMMARY
        docker run --rm -v "${{ github.workspace }}:/src" clamav/clamav clamscan -r  /src/edge-ai-suites/manufacturing-ai-suite/industrial-edge-insights-vision/ > ./reports/clamav-report.txt || true
        echo "Please find full report in clamav-report.txt" >> $GITHUB_STEP_SUMMARY 
    - name: Upload Scan Reports
      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6.0.0
      with:
        name: virus-report
        path: reports/
    
  shellcheck:
    runs-on: ubuntu-latest

    steps:
      - name: Check out edge-ai-suites repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false
          path: edge-ai-suites-repo

      - name: Install ShellCheck
        run:  sudo apt-get update &&  sudo apt-get install -y shellcheck

      - name: Run ShellCheck
        run: |
          cd edge-ai-suites-repo/manufacturing-ai-suite/industrial-edge-insights-vision/
          echo "Scanning for .sh files and running ShellCheck..."
          find . -type f -name "*.sh" | tee shell_files.txt | xargs -r shellcheck -f gcc > shellcheck_report.txt || true
          echo "### ShellCheck Results" >> $GITHUB_STEP_SUMMARY
          echo "Please find ShellCheck report in shellcheck_report.txt" >> $GITHUB_STEP_SUMMARY
          cp shellcheck_report.txt ${{ github.workspace }}

      - name: Upload ShellCheck report
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6.0.0
        with:
          name: shellcheck-report
          path: shellcheck_report.txt

  trivy-config-helm-scan:
    permissions:
      contents: read
      packages: read          # needed for actions/checkout
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout Code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false  
      - name: Install Trivy from Aqua Security APT repo
        run: |
          sudo apt-get update
          sudo apt-get install -y gnupg lsb-release wget apt-transport-https curl jq
          curl -fsSL https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo gpg --dearmor -o /usr/share/keyrings/trivy.gpg
          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -cs) main" | \
          sudo tee /etc/apt/sources.list.d/trivy.list > /dev/null
          sudo apt-get update
          sudo apt-get install -y trivy
      - name: Download Trivy Vulnerability DB and Report Format
        continue-on-error: true
        shell: bash
        run: |
          pwd
          cd manufacturing-ai-suite/industrial-edge-insights-vision/
          trivy --version
          which trivy
          trivy image --download-db-only
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/html.tpl -o trivy-html.tpl
          cat << 'EOF' > csv.tpl
          {{ range . }}
          Trivy Vulnerability Scan Results ({{- .Target -}})
          VulnerabilityID,Severity,CVSS Score,Title,Library,Vulnerable Version,Fixed Version,Information URL,Triage Information
          {{ range .Vulnerabilities }}
              {{- .VulnerabilityID }},
              {{- .Severity }},
              {{- range $key, $value := .CVSS }}
                  {{- if (eq $key "nvd") }}
                      {{- .V3Score -}}
                  {{- end }}
              {{- end }},
              {{- quote .Title }},
              {{- quote .PkgName }},
              {{- quote .InstalledVersion }},
              {{- quote .FixedVersion }},
              {{- .PrimaryURL }}
          {{ else -}}
              No vulnerabilities found at this time.
          {{ end }}
          Trivy Dependency Scan Results ({{ .Target }})
          ID,Name,Version,Notes
          {{ range .Packages -}}
              {{- quote .ID }},
              {{- quote .Name }},
              {{- quote .Version }}
          {{ else -}}
              No dependencies found at this time.
          {{ end }}
          {{ end }}
          EOF

      - name: Trivy config scan for helm charts 
        run: |
          cd manufacturing-ai-suite/industrial-edge-insights-vision/helm
          sed -i "s/username:*/username: user/g" values.yaml 
          sed -i "s/password:*/password: password/g" values.yaml
          trivy config . >> trivy-Spineapp-helm.txt
          
      - name: Upload Scan artifact to Github
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f #v6.0.0
        with:
          name: Trivy Report - Config scan for Helm
          path: manufacturing-ai-suite/industrial-edge-insights-vision/helm/trivy-Spineapp-helm.txt
       
  sanity:
    uses: ./.github/workflows/spineapp_sanity.yaml
    with:
      branch:  ${{ github.head_ref }}
    secrets: inherit            
    permissions:
      contents: read           
      packages: write