name: "Trivy Report"
description: "Generate a vulnerability report from a Trivy scan in a GitHub PR in form of comments"
author: "Timo Behrendt"
branding:
  icon: "shield"
  color: "blue"

inputs:
  version:
    description: "The version of the Trivy report to generate a report from"
    required: false
    default: "0.1.1"
  architecture:
    description: "The architecture of the Trivy report to generate a report from"
    required: false
    default: "amd64"
  url:
    description: "The URL of the Gitea instance"
    required: false
    default: "https://gitea.t000-n.de"
  username:
    description: "The username to use for authentication and will be the creator of the comments/issues"
    required: true
  token:
    description: "The token to use for authentication"
    required: true
  owner:
    description: "The owner of the repository"
    required: true
  repo:
    description: "The repository name"
    required: true
  pr:
    description: "The pull request number"
    required: true
  output:
    description: "The output type. Currently only review is supported"
    required: false
    default: "review"
  filter:
    description: "The filter to use for the report. Can be either 'pr-changes' to only include new vulnerabilities that got introduced through the PR or 'all' to include all vulnerabilities"
    required: false
    default: "pr-changes"
  report:
    description: "The path to the report fiel generated by Trivy. Needs to be standard 'json' output of Trivy's vulnerability reportt"
    required: false
    default: "report.json"

runs:
  using: "composite"
  steps:
    - name: Cache Trivy-Reporter binary
      id: cache-trivy-reporter
      uses: actions/cache@v4
      with:
        path: /usr/local/bin/trivy-reporter-linux-${{ inputs.architecture }}
        key: trivy-reporter-${{ inputs.version }}-${{ inputs.architecture }}
        restore-keys: |
          trivy-reporter-${{ inputs.version }}-${{ inputs.architecture }}-
          trivy-reporter-${{ inputs.version }}-
    - name: Validate inputs
      shell: bash
      run: |
        set -e

        ARCH="${{ inputs.architecture }}"

        # Validate architecture
        case "$ARCH" in
          amd64|arm64)
            ;;
          *)
            echo "Error: Unsupported architecture '$ARCH'. Supported: amd64, arm64"
            exit 1
            ;;
        esac
    - name: Download and install Trivy-Reporter
      if: steps.cache-trivy-reporter.outputs.cache-hit != 'true'
      shell: bash
      run: |
        set -e

        VERSION="${{ inputs.version }}"
        ARCH="${{ inputs.architecture }}"

        mkdir -p /usr/local/bin

        curl -sL "https://gitea.t000-n.de/t.behrendt/trivy-reporter/releases/download/${VERSION}/trivy-reporter-linux-${ARCH}" -o /usr/local/bin/trivy-reporter-linux-${ARCH}
    - name: Create Trivy Report
      shell: bash
      run: |
        trivy-reporter-linux-${{ inputs.architecture }} \
          -platform "gitea"
          -url ${{ inputs.url }}
          -username ${{ inputs.username }}
          -token ${{ inputs.token }}
          -owner ${{ inputs.owner }}
          -repo ${{ inputs.repo }}
          -pr ${{ inputs.pr }}
          -output "${{ inputs.output }}"
          -filter "${{ inputs.filter }}"
          -report "${{ inputs.report }}"