security.yaml

name: Vulnerability Scan

on:
  workflow_dispatch:
  push:
    branches: ["release/**"]
    paths-ignore:
      - "security/sbom/**"

permissions:
  contents: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-image:
    name: Build Docker Image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image (no push)
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          load: true
          tags: landscape-ui:scan

      - name: Save image to a tar file
        run: docker save landscape-ui:scan -o image.tar

      - name: Upload image artifact
        uses: actions/upload-artifact@v4
        with:
          name: image-tar
          path: image.tar
          retention-days: 1

  scan-and-report:
    name: Vulnerability Scan
    needs: build-image
    runs-on:
      [self-hosted, self-hosted-linux-amd64-jammy-private-endpoint-medium]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Download image artifact
        uses: actions/download-artifact@v4
        with:
          name: image-tar

      - name: Install secscan client
        run: |
          sudo snap install canonical-secscan-client
          sudo snap connect canonical-secscan-client:home system:home

      - name: Determine SSDLC metadata
        id: meta
        run: |
          VERSION=$(node scripts/calculate-version.cjs)
          BRANCH="${GITHUB_REF_NAME}"
          if [[ "$BRANCH" =~ ^release/([0-9]{2}\.(04|10))$ ]]; then
            CYCLE="${BASH_REMATCH[1]}"
          else
            # workflow_dispatch from a non-release branch: fall back to the
            # current calendar cycle (same rule as calculate-version.cjs).
            CYCLE=$(node -e "const m=new Date().getMonth()+1,y=new Date().getFullYear();console.log(m<=4?String(y).slice(-2)+'.04':m<=10?String(y).slice(-2)+'.10':String(y+1).slice(-2)+'.04')")
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "cycle=$CYCLE" >> "$GITHUB_OUTPUT"
          echo "Submitting as version=$VERSION cycle=$CYCLE"

      - name: Run security scan
        id: scan
        run: |
          set +e
          secscan-client --batch submit \
            --ssdlc-product-name 'landscape-ui' \
            --ssdlc-cycle '${{ steps.meta.outputs.cycle }}' \
            --ssdlc-product-version '${{ steps.meta.outputs.version }}' \
            --ssdlc-product-channel 'edge' \
            --scanner trivy \
            --type container-image \
            --format oci \
            image.tar \
            --wait-and-print | tee secscan-results.txt
          EXIT_CODE=${PIPESTATUS[0]}
          echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
          exit "$EXIT_CODE"

      - name: Upload scan results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: secscan-results
          path: secscan-results.txt

  generate-and-commit-sbom:
    name: Generate SBOM
    needs: build-image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Download image artifact
        uses: actions/download-artifact@v4
        with:
          name: image-tar

      - name: Generate SBOM via Trivy
        uses: aquasecurity/trivy-action@v0.35.0
        with:
          input: image.tar
          format: "spdx-json"
          output: "dependency-results.sbom.json"
          github-pat: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload SBOM as artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom-report-json
          path: "dependency-results.sbom.json"
          retention-days: 30

      - name: Commit SBOM to release branch
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/heads/release/')
        run: |
          set -e
          mkdir -p security/sbom
          mv dependency-results.sbom.json security/sbom/release.spdx.json

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

          if git diff --quiet -- security/sbom/release.spdx.json; then
            echo "SBOM unchanged; nothing to commit."
            exit 0
          fi

          VERSION=$(node scripts/calculate-version.cjs)
          git add security/sbom/release.spdx.json
          git commit -m "chore(sbom): refresh for ${VERSION} [skip ci]"

          # Race protection: if another commit lands between scan and push,
          # rebase and retry. The SBOM is a full overwrite, so rebases resolve
          # cleanly without conflict markers.
          for attempt in 1 2 3; do
            if git push origin HEAD:"${GITHUB_REF_NAME}"; then
              exit 0
            fi
            echo "Push attempt $attempt failed; rebasing and retrying."
            git pull --rebase origin "${GITHUB_REF_NAME}"
          done
          echo "Failed to push SBOM after 3 attempts" >&2
          exit 1