vulnerability-check.yml

name: Vulnerability Check

on:
  pull_request:
    branches: [main, "release-[0-9]*.[0-9]*"]

permissions:
  contents: read
  issues: write

concurrency:
  group: vulnerability-check-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

env:
  GOTOOLCHAIN: auto

jobs:
  govulncheck:
    name: govulncheck
    runs-on: ubuntu-26.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: $/.github/actions/setup-go-cached
        with:
          go-version-file: src/go.mod
          go-sum-path: src/go.sum

      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
        with:
          node-version: 24
          package-manager-cache: false

      - uses: $/.github/actions/setup-task
        with:
          version: 3.49.1

      - name: Load tool versions
        id: versions
        run: |
          gh_cli_version=""
          govulncheck_version=""
          while IFS='=' read -r name value; do
            case "${name}" in
              GH_CLI_VERSION) gh_cli_version="${value}" ;;
              GOVULNCHECK_VERSION) govulncheck_version="${value}" ;;
            esac
          done < versions.env
          if ! [[ "${gh_cli_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "GH_CLI_VERSION must be X.Y.Z" >&2
            exit 1
          fi
          if ! [[ "${govulncheck_version}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            echo "GOVULNCHECK_VERSION must be vX.Y.Z" >&2
            exit 1
          fi
          echo "GH_CLI_VERSION=${gh_cli_version}" >> "${GITHUB_ENV}"
          echo "GOVULNCHECK_VERSION=${govulncheck_version}" >> "${GITHUB_ENV}"
          echo "gh-cli-version=${gh_cli_version}" >> "${GITHUB_OUTPUT}"
          echo "govulncheck-version=${govulncheck_version}" >> "${GITHUB_OUTPUT}"

      - name: Install GitHub CLI
        run: |
          case "$(uname -m)" in
            x86_64|amd64) arch="amd64" ;;
            aarch64|arm64) arch="arm64" ;;
            *) echo "Unsupported architecture for gh: $(uname -m)" >&2; exit 1 ;;
          esac

          archive="gh_${GH_CLI_VERSION}_linux_${arch}.tar.gz"
          tool_dir="${RUNNER_TEMP:-${PWD}/.tools}/gh-cli"
          mkdir -p "${tool_dir}/bin"
          curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_CLI_VERSION}/${archive}" -o "${tool_dir}/${archive}"
          curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_CLI_VERSION}/gh_${GH_CLI_VERSION}_checksums.txt" -o "${tool_dir}/gh_checksums.txt"
          (cd "${tool_dir}" && grep "  ${archive}$" gh_checksums.txt | sha256sum -c -)
          tar -xzf "${tool_dir}/${archive}" -C "${tool_dir}"
          install -m 0755 "${tool_dir}/gh_${GH_CLI_VERSION}_linux_${arch}/bin/gh" "${tool_dir}/bin/gh"
          echo "${tool_dir}/bin" >> "${GITHUB_PATH}"

      - name: Install govulncheck
        run: |
          go install "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}"
          echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}"

      - name: Verify installed tools
        run: |
          git --version
          gh --version
          go version
          node --version
          task --version
          govulncheck -version

      - name: Generate API code
        run: task build:gen-apis

      - name: Run govulncheck
        run: |
          mkdir -p vulnerability-check
          set +e
          (
            cd src
            govulncheck -format json ./... > ../vulnerability-check/govulncheck.json 2> ../vulnerability-check/govulncheck.stderr
          )
          exit_code=$?
          set -e
          printf '%s\n' "${exit_code}" > vulnerability-check/govulncheck.exit

      - name: Generate vulnerability summary
        run: |
          node tools/vulnerability-check/render-govulncheck-summary.mjs
        env:
          GOVULNCHECK_JSON: vulnerability-check/govulncheck.json
          GOVULNCHECK_STDERR: vulnerability-check/govulncheck.stderr
          GOVULNCHECK_EXIT_FILE: vulnerability-check/govulncheck.exit
          VULN_COMMENT_PATH: vulnerability-check/comment.md
          VULN_SUMMARY_PATH: vulnerability-check/summary.json

      - name: Generate fixable vulnerability comment
        run: |
          node tools/vulnerability-check/render-govulncheck-summary.mjs
        env:
          GOVULNCHECK_JSON: vulnerability-check/govulncheck.json
          GOVULNCHECK_STDERR: vulnerability-check/govulncheck.stderr
          GOVULNCHECK_EXIT_FILE: vulnerability-check/govulncheck.exit
          VULN_COMMENT_MODE: fixable
          VULN_COMMENT_PATH: vulnerability-check/comment.md
          VULN_SUMMARY_PATH: vulnerability-check/comment-summary.json
          VULN_APPEND_STEP_SUMMARY: "false"

      - name: Comment vulnerability summary
        if: github.event.pull_request.head.repo.full_name == github.repository
        env:
          GH_TOKEN: ${{ github.token }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          fixable_count=$(node -e "const fs = require('node:fs'); const summary = JSON.parse(fs.readFileSync('vulnerability-check/summary.json', 'utf8')); console.log(summary.fixableFindingCount || 0);")
          comment_id=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" | node -e '
          const fs = require("node:fs");
          const pages = JSON.parse(fs.readFileSync(0, "utf8"));
          const comments = pages.flat();
          const comment = comments.find((item) => item.body?.includes("<!-- harbor-next-vulnerability-check -->"));
          console.log(comment?.id || "");
          '
          )

          if [ "${fixable_count}" -eq 0 ]; then
            if [ -n "${comment_id}" ]; then
              gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${comment_id}" --method DELETE || {
                echo "Unable to delete stale vulnerability comment; continuing." >> "${GITHUB_STEP_SUMMARY}"
              }
            fi
            exit 0
          fi

          body=$(cat vulnerability-check/comment.md)
          if [ -n "${comment_id}" ]; then
            gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${comment_id}" \
              --method PATCH \
              --field "body=${body}" || {
                echo "Unable to update vulnerability comment; continuing." >> "${GITHUB_STEP_SUMMARY}"
              }
          else
            gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
              --method POST \
              --field "body=${body}" || {
                echo "Unable to create vulnerability comment; continuing." >> "${GITHUB_STEP_SUMMARY}"
              }
          fi

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: vulnerability-check
          path: vulnerability-check/
          if-no-files-found: warn

      - name: Enforce scanner health
        run: |
          node <<'NODE'
          const { readFileSync } = require('node:fs');
          const summary = JSON.parse(readFileSync('vulnerability-check/summary.json', 'utf8'));
          if (summary.scannerError) {
            console.error('govulncheck failed before producing vulnerability findings.');
            process.exit(1);
          }
          console.log(`govulncheck completed with ${summary.findingCount} vulnerabilities.`);
          NODE