# Generated by `starci compile` from security.ci.star. Edit that, not this.
#
# Each job is one step of the plan: the same image, command, tools and
# packages, given only the step's inputs. A job skips its work when it has
# already passed with the same inputs.
#
# What does not carry over:
#  - Passes are remembered in this repository's Actions cache, which GitHub
#    scopes by branch and evicts when old. starci's own store has neither
#    limit.

name: CI

on:
  push:
    branches: ['**']
    tags: ['**']
  pull_request:
  workflow_dispatch:

jobs:
  secrets:
    name: "secrets"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-secrets-4961da7da930b596-${{ hashFiles('**', '!.git/**') }}
      - name: "secrets"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            gitleaks dir . --no-banner --redact
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            zricethezav/gitleaks:latest sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"

  dependencies:
    name: "dependencies"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /**/go.sum
            /**/package-lock.json
            /**/uv.lock
      - name: "dependencies"
        env:
          STARCI_RUN: |-
            trivy fs --scanners vuln --exit-code 1 --severity HIGH,CRITICAL .
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            aquasec/trivy:latest sh -c "$STARCI_RUN"

  dockerfile:
    name: "dockerfile"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /Dockerfile
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-dockerfile-3d2d0d6bd8b032e1-${{ hashFiles('Dockerfile', 'Dockerfile/**') }}
      - name: "dockerfile"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            hadolint Dockerfile
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            hadolint/hadolint:latest-debian sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"