## Copyright 2024-2026 Intel Corporation
## SPDX-License-Identifier: BSD-3-Clause

name: Hardening Checks (release)

permissions: read-all

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: 'Release tag (e.g., v1.21.1)'
        required: true
        type: string
        default: 'v1.21.1'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  hardening_check:
    runs-on: ubuntu-latest
    # Disabling this workflow for non ispc/ispc repo as it needs to run on releases only.
    if: github.repository == 'ispc/ispc'

    env:
      LINK: https://github.com/ispc/ispc/releases/download/${{ inputs.release_tag }}/ispc-${{ inputs.release_tag }}-linux.tar.gz

    steps:
    - name: Install hardening-check script
      run: |
        sudo apt -y update
        sudo apt install -y devscripts

    - name: Download and check Linux artifacts
      run: |
        echo "Download artifact ${LINK}" >> "$GITHUB_STEP_SUMMARY"
        wget --quiet -O "ispc.tar.gz" "${LINK}"
        tar xf "ispc.tar.gz"
        # Find the actual directory name that was created
        ISPC_DIR=$(find . -type d -name "ispc*" -maxdepth 1)
        hardening-check "${ISPC_DIR}/bin/ispc" | tee -a "./hardening-check-${INPUTS_RELEASE_TAG}.txt"
        hardening-check "${ISPC_DIR}/lib/libispc.so" | tee -a "./hardening-check-${INPUTS_RELEASE_TAG}.txt"
        hardening-check "${ISPC_DIR}/lib/libispcrt.so" | tee -a "./hardening-check-${INPUTS_RELEASE_TAG}.txt"
        hardening-check "${ISPC_DIR}/lib/libispcrt_device_gpu.so" | tee -a "./hardening-check-${INPUTS_RELEASE_TAG}.txt"
        hardening-check "${ISPC_DIR}/lib/libispcrt_device_cpu.so" | tee -a "./hardening-check-${INPUTS_RELEASE_TAG}.txt"
      env:
        INPUTS_RELEASE_TAG: ${{ inputs.release_tag }}

    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: hardening_check
        path: |
          hardening-check-${{ inputs.release_tag }}.txt

  winchecksec:
    runs-on: windows-2022
    # Disabling this workflow for non ispc/ispc repo as it needs to run on releases only.
    if: github.repository == 'ispc/ispc'

    env:
      WINCHECKSEC_URL: https://github.com/trailofbits/winchecksec/releases/download/v3.1.0/windows.x64.Release.zip
      LINK: https://github.com/ispc/ispc/releases/download/${{ inputs.release_tag }}/ispc-${{ inputs.release_tag }}-windows.zip

    steps:
    - name: Install winchecksec
      run: |
        Install-ChocoPackage wget
        wget -q $env:WINCHECKSEC_URL
        unzip windows.x64.Release.zip
        echo "$pwd\build\Release" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

    - name: Download and check Windows artifacts
      run: |
        echo "Download artifact %LINK%" >> %GITHUB_STEP_SUMMARY%
        wget -q $env:LINK
        7z.exe x ispc*
        cd ispc-*
        winchecksec.exe bin\ispc.exe >> ..\winchecksec-report-$env:INPUTS_RELEASE_TAG.txt
        winchecksec.exe bin\ispc.dll >> ..\winchecksec-report-$env:INPUTS_RELEASE_TAG.txt
        winchecksec.exe bin\ispcrt.dll >> ..\winchecksec-report-$env:INPUTS_RELEASE_TAG.txt
        winchecksec.exe bin\ispcrt_device_cpu.dll >> ..\winchecksec-report-$env:INPUTS_RELEASE_TAG.txt
        winchecksec.exe bin\ispcrt_device_gpu.dll >> ..\winchecksec-report-$env:INPUTS_RELEASE_TAG.txt
      env:
        INPUTS_RELEASE_TAG: ${{ inputs.release_tag }}

    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: winchecksec_report
        path: |
          winchecksec-report-${{ inputs.release_tag }}.txt
