## Copyright 2024-2026 Intel Corporation
## SPDX-License-Identifier: BSD-3-Clause

name: Hardening Checks (trunk)

permissions: read-all

on:
  workflow_dispatch:
  schedule:
    # Run every day at 22:00 UTC
    - cron: '0 22 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  ZIP_URL: https://github.com/ispc/ispc/releases/download/trunk-artifacts/ispc-trunk-windows.zip
  TAR_URL: https://github.com/ispc/ispc/releases/download/trunk-artifacts/ispc-trunk-linux.tar.gz

jobs:
  hardening_check:
    runs-on: ubuntu-latest
    # Disabling this workflow for non ispc/ispc repo to reduce the traffic to artifacts downloads.
    if: github.repository == 'ispc/ispc'

    steps:
    - name: Install hardening-check script
      run: |
        sudo apt -y update
        sudo apt install -y devscripts

    - name: Download and check Linux artifacts
      run: |
        echo "Download artifact ${tar_url}" >> "$GITHUB_STEP_SUMMARY"
        wget --quiet -O "ispc.tar.gz" "${{ env.TAR_URL }}"
        tar xf "ispc.tar.gz"
        # Find the actual directory name that was created
        ISPC_DIR=$(find . -type d -name "ispc*" -maxdepth 1)

        hardening-check "${ISPC_DIR}/bin/ispc" | tee -a "./hardening-check-trunk.txt"
        hardening-check "${ISPC_DIR}/lib/libispc.so" | tee -a "./hardening-check-trunk.txt"
        hardening-check "${ISPC_DIR}/lib/libispcrt.so" | tee -a "./hardening-check-trunk.txt"
        hardening-check "${ISPC_DIR}/lib/libispcrt_device_gpu.so" | tee -a "./hardening-check-trunk.txt"
        hardening-check "${ISPC_DIR}/lib/libispcrt_device_cpu.so" | tee -a "./hardening-check-trunk.txt"

    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: hardening_check
        path: |
          hardening-check-trunk.txt

  winchecksec:
    runs-on: windows-2022
    # Disabling this workflow for non ispc/ispc repo to reduce the traffic to artifacts downloads.
    if: github.repository == 'ispc/ispc'

    env:
      WINCHECKSEC_URL: https://github.com/trailofbits/winchecksec/releases/download/v3.1.0/windows.x64.Release.zip

    steps:
    - name: Install winchecksec
      run: |
        Install-ChocoPackage wget
        wget -q $env:WINCHECKSEC_URL
        unzip windows.x64.Release.zip
        echo "$pwd\build\Release" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

    - name: Download and check Windows artifacts
      run: |
        echo "Download artifact %ZIP_URL%" >> %GITHUB_STEP_SUMMARY%
        wget -q -O archive.zip $env:ZIP_URL
        7z.exe x archive.zip
        cd ispc-*
        winchecksec.exe bin\ispc.exe >> ..\winchecksec-report-trunk.txt
        winchecksec.exe bin\ispc.dll >> ..\winchecksec-report-trunk.txt
        winchecksec.exe bin\ispcrt.dll >> ..\winchecksec-report-trunk.txt
        winchecksec.exe bin\ispcrt_device_cpu.dll >> ..\winchecksec-report-trunk.txt
        # Not GPU device is built in trunk Windows build
        # winchecksec.exe bin\ispcrt_device_gpu.dll >> ..\winchecksec-report-trunk.txt

    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
      with:
        name: winchecksec_report
        path: |
          winchecksec-report-trunk.txt
