osv-scanner-reusable-pr.yml

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: OSV-Scanner PR scanning reusable

# Restrict jobs in this workflow to have no permissions by default; permissions
# should be granted per job as needed using a dedicated `permissions` block
permissions: {}

on:
  workflow_call:
    inputs:
      scan-args:
        description: "Custom osv-scanner arguments (See https://google.github.io/osv-scanner/usage/ for options, you cannot set --format or --output)"
        type: string
        default: |-
          -r
          --skip-git
          ./
      results-file-name:
        description: "File name of the result SARIF file"
        type: string
        default: results.sarif
      upload-sarif:
        description: "Whether to upload to Security > Code Scanning"
        type: boolean
        required: false
        default: true
      fail-on-vuln:
        description: "Whether to fail the action on vulnerability found"
        type: boolean
        default: true

jobs:
  scan-pr:
    permissions:
      contents: read # to fetch code (actions/checkout)
      security-events: write # for uploading SARIF files
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          # Do persist credentials, as we need it for the git checkout later
      - name: "Checkout target branch"
        run: git checkout $GITHUB_BASE_REF
      - name: "Run scanner on existing code"
        uses: google/osv-scanner/actions/scanner@main
        continue-on-error: true
        with:
          scan-args: |-
            --format=json
            --output=old-results.json
            ${{ inputs.scan-args }}
      - name: "Checkout current branch"
        run: git checkout $GITHUB_SHA
      - name: "Run scanner on new code"
        uses: google/osv-scanner/actions/scanner@main
        with:
          scan-args: |-
            --format=json
            --output=new-results.json
            ${{ inputs.scan-args }}
        continue-on-error: true
      - name: "Run osv-scanner-reporter"
        uses: google/osv-scanner/actions/reporter@main
        with:
          scan-args: |-
            --output=${{ inputs.results-file-name }}
            --old=old-results.json
            --new=new-results.json
            --gh-annotations=true
            --fail-on-vuln=${{ inputs.fail-on-vuln }}
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
        if: "!cancelled()"
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: SARIF file
          path: ${{ inputs.results-file-name }}
          retention-days: 5
      - name: "Upload old scan json results"
        if: "!cancelled()"
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: old-json-results
          path: old-results.json
          retention-days: 5
      - name: "Upload new scan json results"
        if: "!cancelled()"
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: new-json-results
          path: new-results.json
          retention-days: 5
      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
        if: ${{ !cancelled() && inputs.upload-sarif == true }}
        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
        with:
          sarif_file: ${{ inputs.results-file-name }}