name: scan

# Weekly vulnerability check that does not depend on a push. The base image digests
# in docker/Dockerfile are pinned and refreshed by hand, so a new fixable HIGH or
# CRITICAL advisory in the pinned image, or a new advisory in the locked
# dependencies, turns this run red: the reminder to refresh the digests (see the
# comment at the top of docker/Dockerfile) or bump the dependency.
#
# Same rules as ci.yml: third-party actions pinned to a commit SHA, resources named
# per run and removed by name, no pruning.

on:
  schedule:
    - cron: '17 5 * * 1'
  workflow_dispatch:

env:
  UV_PYTHON_DOWNLOADS: never
  UV_NO_PROGRESS: "1"

jobs:
  image-scan:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      SCAN_IMAGE: aegis-ci-${{ github.run_id }}-scan:test
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Build image
        run: docker build -f docker/Dockerfile -t "${SCAN_IMAGE}" .
      - name: Install Trivy
        shell: bash
        run: |
          bin_dir="${RUNNER_TEMP:-/tmp}/trivy-bin"
          bash scripts/ci/install_trivy.sh "${bin_dir}"
          echo "${bin_dir}" >> "$GITHUB_PATH"
      - name: Scan image
        shell: bash
        run: bash scripts/ci/scan_image.sh "${SCAN_IMAGE}"
      - name: Cleanup
        if: always()
        shell: bash
        run: bash scripts/ci/cleanup_job_resources.sh "${SCAN_IMAGE}"

  dependency-audit:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
      - name: Set up uv
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
        with:
          version: "0.12.5"
          enable-cache: false
      - name: Install dependencies
        run: uv sync --locked
      - name: Dependency audit
        run: bash scripts/ci/pip_audit.sh