# Copyright 2024-2026, Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause

name: Scan release archives with cve-bin-tool

permissions: read-all

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'ISPC release version (just number without v, e.g., 1.24.0)'
        required: true
        type: string

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  release_base_url: https://github.com/ispc/ispc/releases/download/

jobs:
  scan:
    runs-on: ubuntu-latest
    # Disabling this workflow for non ispc/ispc repo as it needs to run on releases only.
    if: github.repository == 'ispc/ispc'

    steps:
    - name: Install cve-bin-tool
      run: |
        pip3 install cve-bin-tool[PDF]

    - name: Download ISPC release archives
      env:
        V: ${{ inputs.version }}
      run: |
        FILES=("ispc-examples-v$V.tar.gz"
              "ispc-v$V-linux.aarch64.tar.gz"
              "ispc-v$V-linux.tar.gz"
              "ispc-v$V-macOS.arm64.tar.gz"
              "ispc-v$V-macOS.universal.tar.gz"
              "ispc-v$V-macOS.x86_64.tar.gz"
              "ispc-examples-v$V.zip"
              "ispc-v$V-windows.zip")

        # Download all files in a single loop
        for f in "${FILES[@]}"; do
          echo "Downloading $f"
          wget --quiet -O "$f" "${{ env.release_base_url }}/v$V/$f"
        done

    - name: Scan archvies with cve-bin-tool
      timeout-minutes: 30
      run: |
        # Use json-nvd source to avoid flaky mirror.cveb.in
        # Disable EPSS, PURL2CPE, OSV sources that have connectivity issues
        cve-bin-tool ./ -f console,pdf,html -o report -n json-nvd -d EPSS,PURL2CPE,OSV

    - name: Upload reports
      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: always()
      with:
        name: reports
        path: |
          report.txt
          report.pdf
          report.html
