# Generated by `starci compile --target circleci` from security.ci.star. Edit that, not this.
#
# Each job is one step of the plan: the same image, command, tools and
# packages, given only the step's inputs. A job skips its work when it has
# already passed with the same inputs.
#
# What does not carry over:
#  - Passes are remembered in this project's CircleCI cache, which expires.
#    starci's own store does not.

version: 2.1

jobs:
  secrets:
    machine:
      image: ubuntu-2404:current
    resource_class: medium
    steps:
      - checkout
      - run:
          name: "Identify the inputs"
          command: |
            git ls-files -s -- ':(top)' > /tmp/starci-inputs
      - restore_cache:
          name: Has this already passed with these inputs?
          keys:
            - starci-passed-secrets-4961da7da930b596-{{ checksum "/tmp/starci-inputs" }}
      - run:
          name: "Stop here if it has"
          command: |
            if [ -e ~/starci-passed/at ]; then
              echo "Passed before with the same inputs, on $(cat ~/starci-passed/at). Nothing to do."
              circleci-agent step halt
            fi
      - run:
          name: "secrets"
          environment:
            STARCI_RUN: |-
              gitleaks dir . --no-banner --redact
          command: |
            docker run --rm \
              -v "$PWD:/workspace" \
              -w /workspace \
              zricethezav/gitleaks:latest sh -c "$STARCI_RUN"
      - run:
          name: "Remember this pass"
          command: |
            mkdir -p ~/starci-passed && date > ~/starci-passed/at
      - save_cache:
          key: starci-passed-secrets-4961da7da930b596-{{ checksum "/tmp/starci-inputs" }}
          paths:
            - ~/starci-passed

  dependencies:
    machine:
      image: ubuntu-2404:current
    resource_class: medium
    steps:
      - checkout
      - run:
          name: "Keep only this step's inputs"
          command: |
            git sparse-checkout set --no-cone '/**/go.sum' '/**/package-lock.json' '/**/uv.lock'
      - run:
          name: "dependencies"
          environment:
            STARCI_RUN: |-
              trivy fs --scanners vuln --exit-code 1 --severity HIGH,CRITICAL .
          command: |
            docker run --rm \
              -v "$PWD:/workspace" \
              -w /workspace \
              aquasec/trivy:latest sh -c "$STARCI_RUN"

  dockerfile:
    machine:
      image: ubuntu-2404:current
    resource_class: medium
    steps:
      - checkout
      - run:
          name: "Keep only this step's inputs"
          command: |
            git sparse-checkout set --no-cone '/Dockerfile'
      - run:
          name: "Identify the inputs"
          command: |
            git ls-files -s -- ':(top,literal)Dockerfile' > /tmp/starci-inputs
      - restore_cache:
          name: Has this already passed with these inputs?
          keys:
            - starci-passed-dockerfile-3d2d0d6bd8b032e1-{{ checksum "/tmp/starci-inputs" }}
      - run:
          name: "Stop here if it has"
          command: |
            if [ -e ~/starci-passed/at ]; then
              echo "Passed before with the same inputs, on $(cat ~/starci-passed/at). Nothing to do."
              circleci-agent step halt
            fi
      - run:
          name: "dockerfile"
          environment:
            STARCI_RUN: |-
              hadolint Dockerfile
          command: |
            docker run --rm \
              -v "$PWD:/workspace" \
              -w /workspace \
              hadolint/hadolint:latest-debian sh -c "$STARCI_RUN"
      - run:
          name: "Remember this pass"
          command: |
            mkdir -p ~/starci-passed && date > ~/starci-passed/at
      - save_cache:
          key: starci-passed-dockerfile-3d2d0d6bd8b032e1-{{ checksum "/tmp/starci-inputs" }}
          paths:
            - ~/starci-passed

workflows:
  ci:
    jobs:
      - secrets
      - dependencies
      - dockerfile