hauler/.github/workflows/vulnerability-scan.yaml

name: Vulnerability Scan (Reusable)

on:
  workflow_call:

jobs:
  vulnerability-scan:
    name: Vulnerability Scan
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Clean Up Actions Tools Cache
        run: rm -rf /opt/hostedtoolcache

      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Configure Git
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"

      - name: Set Up Go
        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true

      - name: Install Go Releaser
        uses: goreleaser/goreleaser-action@v6
        with:
          install-only: true

      - name: Install Dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y make
          sudo apt-get install -y build-essential

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Install Trivy
        uses: aquasecurity/setup-trivy@v0.3.1

      - name: Run Vulnerability Scans
        run: make vulns

      - name: Display Vulnerability Reports
        if: always()
        run: |
          echo "::group::govulncheck (vulncheck.out)"
          cat vulncheck.out || echo "vulncheck.out not found"
          echo "::endgroup::"
          echo "::group::trivy fs (trivy.out)"
          cat trivy.out || echo "trivy.out not found"
          echo "::endgroup::"

      - name: Write Vulnerability Reports to Job Summary
        if: always()
        run: |
          {
            echo "## Vulnerability Reports"
            echo ""
            echo "<details><summary>govulncheck (vulncheck.out)</summary>"
            echo ""
            echo '```'
            cat vulncheck.out 2>/dev/null || echo "vulncheck.out not found"
            echo '```'
            echo ""
            echo "</details>"
            echo ""
            echo "<details><summary>trivy fs (trivy.out)</summary>"
            echo ""
            echo '```'
            cat trivy.out 2>/dev/null || echo "trivy.out not found"
            echo '```'
            echo ""
            echo "</details>"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload Vulnerability Reports
        uses: actions/upload-artifact@v6
        if: always()
        with:
          name: vulnerability-reports
          path: |
            vulncheck.out
            trivy.out