action.yaml

# Action's main info
name: "Packj Security Audit"
description: 'Use Packj to avoid malicious and other "risky" open-source software dependencies'

# Action's author name
author: "Ossillate, Inc."

# Action's branding data for GitHub Marketplace
branding:
  icon: "package" # icon name from Feather open source icons pack
  color: "orange"

inputs:
  DEPENDENCY_FILES:
    description: A string params passed to Packj for auditing
    required: true
  REPO_TOKEN:
    description: Your repo GITHUB_TOKEN
    required: true

runs:
  using: "composite"

  steps:
    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    - name: Check out repository code
      uses: actions/checkout@v3
      with:
        fetch-depth: 100

    - name: Get changed files
      id: changed-files
      uses: tj-actions/changed-files@v35

    - name: Detect changed dependencies
      shell: bash
      run: |
        input=$(echo "${{ inputs.DEPENDENCY_FILES }}" | sed 's/,/ /g')
        input_files=()
        audit_files=()
        for item in $input; do
          if [[ $item == *":"* ]]; then
            pm_name=$(echo $item | cut -f1 -d:)
            dep_file=$(echo $item | cut -f2 -d:)
            path=${{ github.workspace }}/$dep_file
            if [ -f $path ]; then
              input_files+=$dep_file" "
              audit_files+=$pm_name":"$path" "
            fi
          fi
        done
        
        echo "Input files: "$input_files
        echo "Audit files: "$audit_files
        echo "Files changed: "${{ steps.changed-files.outputs.all_changed_files }}

        passed=false
        for changed_file in ${{ steps.changed-files.outputs.all_changed_files }}; do
          for input_file in $input_files; do
            if [[ "$changed_file" == "$input_file" ]]; then
              passed=true
              break
            fi
          done
          if [[ $passed == true ]]; then
            echo "Detected new dependencies: $audit_files"
            echo "AUDIT_DEP_FILES=$audit_files" >> $GITHUB_ENV
            break
          fi
        done
  
        echo "Detect changed dependencies -> CHECK_PASSED: $passed"
        echo "CHECK_PASSED=$passed" >> $GITHUB_ENV

    - name: Check for .packj.yaml file in the repo
      if: env.CHECK_PASSED == 'true'
      id: check_files
      uses: andstor/file-existence-action@v2
      with:
        files: ".packj.yaml"
        
    - name: Clone Packj repo
      if: env.CHECK_PASSED == 'true'
      shell: bash
      run: |
        git clone https://github.com/ossillate-inc/packj packj-tool
        echo "Packj repo cloned as packj-tool"
        
    - name: Copy .packj.yaml from the repo
      if: ${{ env.CHECK_PASSED == 'true' && steps.check_files.outputs.files_exists == 'true' }}
      shell: bash
      run: |
        echo ".packj.yaml found in the repo -> Copying it to packj-tool"
        cp .packj.yaml packj-tool/.

    - name: Setup python & pip
      if: env.CHECK_PASSED == 'true'
      uses: actions/setup-python@v4
      with:
        python-version: "3.10"
        cache: pip

    - name: Create virtual environment
      if: env.CHECK_PASSED == 'true'
      shell: bash
      run: python3 -m venv venv

    - name: Activate virtual environment
      if: env.CHECK_PASSED == 'true'
      shell: bash
      run: source venv/bin/activate

    - name: Install Packj's dependencies
      if: env.CHECK_PASSED == 'true'
      shell: bash
      run: pip3 install -r ./packj-tool/requirements.txt

    - name: Auditing deps with Packj
      if: env.CHECK_PASSED == 'true'
      shell: bash
      run: cd ./packj-tool && python3 main.py audit -f ${{ env.AUDIT_DEP_FILES }}

    - name: Analyze audit report
      if: env.CHECK_PASSED == 'true'
      shell: bash
      run: |
        echo "BODY<<EOF" >> $GITHUB_ENV
        if [ -f /tmp/packj_audit_*/*.html ]; then
          html_report=$(ls /tmp/packj_audit_*/*.html)
          cat $html_report | head -n -2 | tail -n +10 | sed 's/^[\s\t\r]*//g' >> $GITHUB_ENV
        else
          echo "<h4>Failed to perform Packj audit! Refer to workflow run for details</h4>" >> /$GITHUB_ENV
        fi
        run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
        commit_link="${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}"
        echo "<h6>Triggered by <a href=$run_url>workflow run ${{ github.run_number }}</a> on commit <a href=$commit_link>${{ github.sha }}</a></h6>"  >> $GITHUB_ENV
        echo "EOF" >> $GITHUB_ENV
        echo "TITLE=Packj audit found risky dependencies!" >> $GITHUB_ENV

    # Create an issue for 'push'
    - name: create issue if ISSUE_REQUIRED is set
      if: ${{ github.head_ref == '' && env.CHECK_PASSED == 'true' }}
      uses: rishabhgupta/git-action-issue@v2
      with:
        token: ${{ inputs.REPO_TOKEN }}
        title: ${{ env.TITLE }}
        body: ${{ env.BODY }}

    # Comment on the PR
    - name: Comment PR
      if: ${{ github.head_ref && env.CHECK_PASSED == 'true' }}
      uses: actions/github-script@v6.4.1
      with:
        script: |
          github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: `<h2><img src="https://packj.dev/static/img/packj-factory-logo.svg" width="24" alt="Packj"> Packj Audit Report</h2> ${{ env.BODY }}`
          })
          

    - name: Comment PR
      if: ${{ github.head_ref && env.CHECK_PASSED == 'false' }}
      uses: actions/github-script@v6.4.1
      with:
        script: |
          github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: `<h2><img src="https://packj.dev/static/img/packj-factory-logo.svg" width="24" alt="Packj"> Packj Audit Report</h2>
          <h4>:white_check_mark: No new dependencies are introduced</h4>
          <h6>Triggered by <a href="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}">workflow run ${{ github.run_number }}</a> on commit <a href="${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}">${{ github.sha }}</a></h6>`
          })