name: "Setup OSV-Scanner"
description: "Download and setup the OSV-Scanner binary for vulnerability scanning"
author: "Gitea Actions"
branding:
  icon: "shield"
  color: "blue"

inputs:
  version:
    description: "OSV-Scanner release tag to download (e.g. v2.3.3). Must match the SHA256 inputs."
    required: false
    default: "v2.3.3"
  sha256_linux_amd64:
    description: "SHA256 (hex) of the osv-scanner_linux_amd64 binary for this version"
    required: false
    default: "777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033"
  sha256_linux_arm64:
    description: "SHA256 (hex) of the osv-scanner_linux_arm64 binary for this version"
    required: false
    default: "0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616"

runs:
  using: "composite"
  steps:
    - shell: bash
      id: arch
      run: |
        set -e
        case "$(uname -m)" in
          x86_64)
            ARCH="amd64"
            ;;
          aarch64)
            ARCH="arm64"
            ;;
          *)
            echo "Unsupported architecture: $(uname -m)" >&2
            exit 1
            ;;
        esac
        echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
    - name: Cache OSV-Scanner binary
      id: cache-osv
      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
      with:
        path: /usr/local/bin/osv-scanner
        key: osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
        restore-keys: |
          osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
    - name: Download and install OSV-Scanner
      if: steps.cache-osv.outputs.cache-hit != 'true'
      shell: bash
      run: |
        set -e
        VERSION="${{ inputs.version }}"
        ARCH="${{ steps.arch.outputs.arch }}"
        case "$ARCH" in
          amd64) EXPECTED="${{ inputs.sha256_linux_amd64 }}" ;;
          arm64) EXPECTED="${{ inputs.sha256_linux_arm64 }}" ;;
          *) echo "internal error: bad ARCH=$ARCH" >&2; exit 1 ;;
        esac
        EXPECTED=$(echo "$EXPECTED" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
        mkdir -p /usr/local/bin
        tmp="$(mktemp)"
        trap 'rm -f "$tmp"' EXIT
        curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "$tmp"
        ACTUAL=$(sha256sum "$tmp" | awk '{print $1}' | tr '[:upper:]' '[:lower:]')
        if [ "$ACTUAL" != "$EXPECTED" ]; then
          echo "SHA256 mismatch for osv-scanner_linux_${ARCH}: expected $EXPECTED, got $ACTUAL" >&2
          exit 1
        fi
        mv "$tmp" /usr/local/bin/osv-scanner
        chmod +x /usr/local/bin/osv-scanner

    - name: Add OSV-Scanner to PATH
      shell: bash
      run: |
        echo "/usr/local/bin" >> $GITHUB_PATH