security-scan.yml

name: Security Scan (Reusable)

on:
  workflow_call:
    inputs:
      default_branch:
        description: 'Default branch of the fork'
        required: true
        type: string

jobs:
  find-pr:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    outputs:
      pr_number: ${{ steps.find.outputs.pr_number }}
      has_pr: ${{ steps.find.outputs.has_pr }}
    steps:
      - name: Checkout shared-workflows scripts
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          repository: tyler-technologies-oss/external-action-shared-workflows
          ref: ${{ github.job_workflow_sha }}
          sparse-checkout: scripts
          path: .shared-workflows

      - name: Find open sync PR
        id: find
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          DEFAULT_BRANCH: ${{ inputs.default_branch }}
        run: bash .shared-workflows/scripts/security-scan/find-sync-pr.sh

  dependency-review:
    needs: find-pr
    if: needs.find-pr.outputs.has_pr == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout upstream-tracking
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: upstream-tracking

      - name: Dependency review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
        with:
          base-ref: refs/heads/${{ inputs.default_branch }}
          head-ref: refs/heads/upstream-tracking
          fail-on-severity: high
          comment-summary-in-pr: never
        continue-on-error: true

  diff-summary:
    needs: find-pr
    if: needs.find-pr.outputs.has_pr == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
    steps:
      - name: Checkout fork
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0

      - name: Checkout shared-workflows scripts
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          repository: tyler-technologies-oss/external-action-shared-workflows
          ref: ${{ github.job_workflow_sha }}
          sparse-checkout: scripts
          path: .shared-workflows

      - name: Generate diff analysis
        id: diff
        env:
          DEFAULT_BRANCH: ${{ inputs.default_branch }}
        run: bash .shared-workflows/scripts/security-scan/generate-diff-analysis.sh

      - name: Analyze composite action changes
        id: composite
        if: steps.diff.outputs.manifest_changes != 'None'
        env:
          BASE_SHA: ${{ steps.diff.outputs.base_sha }}
          HEAD_SHA: ${{ steps.diff.outputs.head_sha }}
        run: bash .shared-workflows/scripts/security-scan/analyze-composite-changes.sh

      - name: Create security alert for composite action changes
        if: |
          steps.composite.outputs.has_composite_findings == 'true' && (
            steps.composite.outputs.changed_refs != 'None' ||
            contains(steps.composite.outputs.run_mod_summary, 'MODIFIED') ||
            steps.composite.outputs.unpinned_refs != 'None' ||
            steps.composite.outputs.using_change != 'None'
          )
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        env:
          PR_NUMBER: ${{ needs.find-pr.outputs.pr_number }}
          CHANGED_REFS: ${{ steps.composite.outputs.changed_refs }}
          RUN_MOD: ${{ steps.composite.outputs.run_mod_summary }}
          UNPINNED: ${{ steps.composite.outputs.unpinned_refs }}
          USING_CHANGE: ${{ steps.composite.outputs.using_change }}
          ADDED_USES: ${{ steps.composite.outputs.added_uses }}
          ADDED_RUNS: ${{ steps.composite.outputs.added_runs }}
        with:
          script: |
            const fn = require('./.shared-workflows/scripts/security-scan/create-composite-alert.js');
            await fn({ github, context });

      - name: Post diff summary as PR comment
        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
        env:
          PR_NUMBER: ${{ needs.find-pr.outputs.pr_number }}
          FILES_CHANGED: ${{ steps.diff.outputs.files_changed }}
          LINES_ADDED: ${{ steps.diff.outputs.lines_added }}
          LINES_REMOVED: ${{ steps.diff.outputs.lines_removed }}
          MANIFEST_CHANGES: ${{ steps.diff.outputs.manifest_changes }}
          SCRIPT_CHANGES: ${{ steps.diff.outputs.script_changes }}
          BINARY_CHANGES: ${{ steps.diff.outputs.binary_changes }}
          HAS_COMPOSITE: ${{ steps.composite.outputs.has_composite_findings }}
          COMPOSITE_USING: ${{ steps.composite.outputs.using_change }}
          COMPOSITE_ADDED_USES: ${{ steps.composite.outputs.added_uses }}
          COMPOSITE_REMOVED_USES: ${{ steps.composite.outputs.removed_uses }}
          COMPOSITE_CHANGED_REFS: ${{ steps.composite.outputs.changed_refs }}
          COMPOSITE_ADDED_RUNS: ${{ steps.composite.outputs.added_runs }}
          COMPOSITE_RUN_MOD: ${{ steps.composite.outputs.run_mod_summary }}
          COMPOSITE_UNPINNED: ${{ steps.composite.outputs.unpinned_refs }}
        with:
          script: |
            const fn = require('./.shared-workflows/scripts/security-scan/post-diff-summary.js');
            await fn({ github, context });

  codeql:
    needs: find-pr
    if: needs.find-pr.outputs.has_pr == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout upstream-tracking
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: upstream-tracking

      - name: Get HEAD SHA
        id: sha
        run: echo "value=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Initialize CodeQL
        id: codeql-init
        uses: github/codeql-action/init@bb471cdcf4dda2c934c5b656f554d43c1434ed13 # v4
        with:
          languages: javascript-typescript
        continue-on-error: true

      - name: Autobuild
        if: steps.codeql-init.outcome == 'success'
        uses: github/codeql-action/autobuild@bb471cdcf4dda2c934c5b656f554d43c1434ed13 # v4
        continue-on-error: true

      - name: Run CodeQL analysis
        if: steps.codeql-init.outcome == 'success'
        uses: github/codeql-action/analyze@bb471cdcf4dda2c934c5b656f554d43c1434ed13 # v4
        with:
          category: "/language:javascript-typescript"
          ref: refs/heads/upstream-tracking
          sha: ${{ steps.sha.outputs.value }}
        continue-on-error: true

  report-status:
    needs: [find-pr, dependency-review, diff-summary, codeql]
    if: always() && needs.find-pr.outputs.has_pr == 'true'
    runs-on: ubuntu-latest
    permissions:
      statuses: write
      checks: write
      pull-requests: read
    steps:
      - name: Checkout shared-workflows scripts
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          repository: tyler-technologies-oss/external-action-shared-workflows
          ref: ${{ github.job_workflow_sha }}
          sparse-checkout: scripts
          path: .shared-workflows

      - name: Report scan statuses on PR
        env:
          GH_TOKEN: ${{ github.token }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ needs.find-pr.outputs.pr_number }}
          DEP_REVIEW_RESULT: ${{ needs.dependency-review.result }}
          DIFF_SUMMARY_RESULT: ${{ needs.diff-summary.result }}
          CODEQL_RESULT: ${{ needs.codeql.result }}
        run: bash .shared-workflows/scripts/security-scan/report-scan-statuses.sh