# Copyright 2024-2026, Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause

name: Scan trunk archives with cve-bin-tool

permissions: read-all

on:
  workflow_dispatch:
  schedule:
    # Run every day at 22:00 UTC
    - cron: '0 22 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  zip_url: https://github.com/ispc/ispc/releases/download/trunk-artifacts/ispc-trunk-windows.zip
  tar_url: https://github.com/ispc/ispc/releases/download/trunk-artifacts/ispc-trunk-linux.tar.gz

jobs:
  scan:
    runs-on: ubuntu-latest
    # Disabling this workflow for non ispc/ispc repo to reduce the traffic to artifacts downloads.
    if: github.repository == 'ispc/ispc'

    steps:
    - name: Install cve-bin-tool
      run: |
        pip3 install cve-bin-tool[PDF]

    - name: Download trunk archives
      run: |
        wget --quiet -O archive.zip ${{ env.zip_url }}
        wget --quiet -O archive.tar.gz ${{ env.tar_url }}

    - name: Scan archvies with cve-bin-tool
      timeout-minutes: 30
      run: |
        # Use json-nvd source to avoid flaky mirror.cveb.in
        # Disable EPSS, PURL2CPE, OSV sources that have connectivity issues
        cve-bin-tool ./ -f console,pdf,html -o report -n json-nvd -d EPSS,PURL2CPE,OSV

    - name: Upload reports
      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      if: always()
      with:
        name: reports
        path: |
          report.txt
          report.pdf
          report.html

