check_gpg_key_not_expired.yml

name: "Check Mondoo's GPG key is not expired"
on:
  workflow_dispatch:
  # Run every day at 00:00
  schedule:
    - cron:  '0 0 * * *'

jobs:
  check_gpg:
    name: Check Mondoo's GPG key has not expired
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Install Mondoo cnspec
        shell: bash
        run: |
          echo Installing Mondoo cnspec...
          bash -c "$(curl -sSL https://install.mondoo.com/sh/cnspec)"
      
      - name: Check expiration of public-package-signing.gpg
        shell: bash
        run: |
          cnspec providers install network
          cnspec scan local --detect-cicd --score-threshold 100 --policy-bundle test/cnspec/check-gpg.mql.yaml -o full

      - name: Install OpenPGP & cURL
        run: sudo apt install gpg -y

      - name: Check Public GPG Signing Key Harmony
        shell: bash
        run: |
          bash test/scripts/cert-harmony.sh
          
      - name: Discord notification
        uses: Ilshidur/action-discord@0.3.2
        if: failure()
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK }}
        with:
          args: ':warning: Mondoo GPG key is expiring or out of sync!  (https://github.com/mondoohq/installer/actions/workflows/check_gpg_key_not_expired.yml)'