action.yml

name: "ScanCode action"
description: "Run ScanCode.io pipelines in your workflows"
inputs:
  pipelines:
    description: "Names of the pipelines (comma-separated) and in order."
    default: "scan_codebase"
  output-formats:
    description: "Output formats"
    default: "json xlsx spdx cyclonedx"
  inputs-path:
    description: "Relative path within the $GITHUB_WORKSPACE for pipeline inputs"
    default: "scancode-inputs"
  input-urls:
    description: "Provide one or more URLs to download for the pipeline run execution."
    required: false
    default: ""
  project-name:
    description: "Name of the project."
    default: "scancode-action"
  outputs-archive-name:
    description: "Name of the outputs archive."
    default: "scancode-outputs"
  check-compliance:
    description: |
      Check for compliance issues in the project.
      Exits with a non-zero status if compliance issues are detected.
    required: false
    default: "false"
  compliance-fail-level:
    description: "Failure level for compliance check. Options: ERROR, WARNING, MISSING."
    required: false
    default: "ERROR"
  compliance-fail-on-vulnerabilities:
    description: |
      Exit with a non-zero status if known vulnerabilities are detected in discovered
      packages and dependencies.
    required: false
    default: "false"
  python-version:
    description: "Python version."
    default: "3.12"
  scancodeio-repo-branch:
    description: "Branch to install ScanCode.io from the GitHub repository (optional)"
    required: false
    default: ""

runs:
  using: "composite"
  steps:
    - uses: actions/setup-python@v5
      with:
        python-version: ${{ inputs.python-version }}

    - name: Set up environment
      shell: bash
      run: |
        echo "SECRET_KEY=$(openssl rand -base64 32)" >> $GITHUB_ENV
        echo "SCANCODEIO_DB_NAME=scancodeio" >> $GITHUB_ENV
        echo "SCANCODEIO_DB_USER=scancodeio" >> $GITHUB_ENV
        echo "SCANCODEIO_DB_PASSWORD=scancodeio" >> $GITHUB_ENV

    - name: Start and setup the PostgreSQL service
      shell: bash
      run: |
        sudo systemctl start postgresql.service
        sudo -u postgres createuser --no-createrole --no-superuser --login --inherit --createdb ${{ env.SCANCODEIO_DB_USER }}
        sudo -u postgres psql -c "ALTER USER ${{ env.SCANCODEIO_DB_USER }} WITH encrypted password '${{ env.SCANCODEIO_DB_PASSWORD }}'"
        sudo -u postgres createdb --owner=scancodeio --encoding=UTF-8 ${{ env.SCANCODEIO_DB_NAME }}

    - name: Install ScanCode.io
      shell: bash
      run: |
        if [ -z "${{ inputs.scancodeio-repo-branch }}" ]; then
          echo "Installing the latest ScanCode.io release from PyPI"
          pip install --upgrade scancodeio
        else
          echo "Installing ScanCode.io from the GitHub branch: ${{ inputs.scancodeio-repo-branch }}"
          pip install git+https://github.com/aboutcode-org/scancode.io.git@${{ inputs.scancodeio-repo-branch }}
        fi

    - name: Run migrations to prepare the database
      shell: bash
      run: scanpipe migrate --verbosity 0

    - name: Generate `--pipeline` CLI arguments
      shell: bash
      run: |
        IFS=',' read -ra PIPELINES <<< "${{ inputs.pipelines }}"
        PIPELINE_CLI_ARGS=""
        for pipeline in "${PIPELINES[@]}"; do
          PIPELINE_CLI_ARGS+=" --pipeline $pipeline"
        done
        echo "PIPELINE_CLI_ARGS=${PIPELINE_CLI_ARGS}" >> $GITHUB_ENV

    - name: Generate `--input-url` CLI arguments
      shell: bash
      run: |
        INPUT_URL_CLI_ARGS=""
        for url in ${{ inputs.input-urls }}; do
          INPUT_URL_CLI_ARGS+=" --input-url $url"
        done
        echo "INPUT_URL_CLI_ARGS=${INPUT_URL_CLI_ARGS}" >> $GITHUB_ENV

    - name: Create project
      shell: bash
      run: |
        scanpipe create-project ${{ inputs.project-name }} \
        ${{ env.PIPELINE_CLI_ARGS }} \
        ${{ env.INPUT_URL_CLI_ARGS }}

    - name: Set project work directory in the environment
      shell: bash
      run: |
        project_status=$(scanpipe status --project ${{ inputs.project-name }})
        work_directory=$(echo "$project_status" | grep -oP 'Work directory:\s*\K[^\n]+')
        echo "PROJECT_WORK_DIRECTORY=$work_directory" >> $GITHUB_ENV

    - name: Copy input files to project work directory
      if: ${{ !inputs.input-urls }}
      shell: bash
      run: |
        SOURCE_PATH="${{ inputs.inputs-path }}"
        [[ "$SOURCE_PATH" != /* ]] && SOURCE_PATH="${{ github.workspace }}/$SOURCE_PATH"
        DESTINATION_PATH="${{ env.PROJECT_WORK_DIRECTORY }}/input/"
        mkdir -p "$DESTINATION_PATH"

        if [ -d "$SOURCE_PATH" ]; then
          if [ "$(ls -A "$SOURCE_PATH")" ]; then
            echo "Copying contents of directory: $SOURCE_PATH → $DESTINATION_PATH"
            cp -r "$SOURCE_PATH"/* "$DESTINATION_PATH"
          else
            echo "Input directory '$SOURCE_PATH' is empty, nothing to copy."
          fi
        else
          echo "Copying file: $SOURCE_PATH → $DESTINATION_PATH"
          cp "$SOURCE_PATH" "$DESTINATION_PATH"
        fi

        echo ""
        echo "Input files now in: $DESTINATION_PATH"
        ls -lh "$DESTINATION_PATH"

    - name: Run the pipelines
      shell: bash
      run: scanpipe execute --project ${{ inputs.project-name }} --no-color

    - name: Generate outputs
      id: scanpipe
      shell: bash
      run: scanpipe output
        --project ${{ inputs.project-name }}
        --format ${{ inputs.output-formats }}

    - name: Upload outputs
      uses: actions/upload-artifact@v4
      id: artifact-upload-step
      with:
        name: ${{ inputs.outputs-archive-name }}
        path: ${{ env.PROJECT_WORK_DIRECTORY }}/output/*
        overwrite: true

    - name: Check compliance
      if: inputs.check-compliance == 'true'
      shell: bash
      run: |
        cmd="scanpipe check-compliance \
          --project ${{ inputs.project-name }} \
          --fail-level ${{ inputs.compliance-fail-level }}"

        if [[ "${{ inputs.compliance-fail-on-vulnerabilities }}" == "true" ]]; then
          cmd="$cmd --fail-on-vulnerabilities"
        fi

        eval "$cmd"