name: "Setup OSV Scanner"
description: "Download and setup osv-scanner binary for vulnerability scanning"
author: "Gitea Actions"
branding:
  icon: "shield"
  color: "blue"

inputs:
  version:
    description: "osv-scanner version to download (e.g., v2.4.0). Must be an explicit release tag; 'latest' is not allowed."
    required: true
  amd64-digest:
    description: "SHA-256 digest of the linux amd64 binary (hex or sha256:<hex>)"
    required: true
  arm64-digest:
    description: "SHA-256 digest of the linux arm64 binary (hex or sha256:<hex>)"
    required: true

runs:
  using: "composite"
  steps:
    - name: Resolve architecture and digest
      shell: bash
      id: arch
      run: |
        set -euo pipefail

        VERSION="${{ inputs.version }}"
        if [ -z "${VERSION}" ] || [ "${VERSION}" = "latest" ]; then
          echo "version must be an explicit release tag (e.g. v2.4.0); 'latest' is not allowed" >&2
          exit 1
        fi

        case "$(uname -m)" in
          x86_64)
            ARCH="amd64"
            DIGEST="${{ inputs.amd64-digest }}"
            ;;
          aarch64)
            ARCH="arm64"
            DIGEST="${{ inputs.arm64-digest }}"
            ;;
          *)
            echo "Unsupported architecture: $(uname -m)" >&2
            exit 1
            ;;
        esac

        if [ -z "${DIGEST}" ]; then
          echo "Missing digest for architecture ${ARCH}" >&2
          exit 1
        fi

        # Normalize sha256:<hex> / SHA256:<hex> to bare hex
        DIGEST="${DIGEST#sha256:}"
        DIGEST="${DIGEST#SHA256:}"

        if ! [[ "${DIGEST}" =~ ^[a-fA-F0-9]{64}$ ]]; then
          echo "Invalid ${ARCH} digest (expected 64-char hex or sha256:<hex>): ${DIGEST}" >&2
          exit 1
        fi

        echo "ARCH=${ARCH}" >> "$GITHUB_OUTPUT"
        echo "DIGEST=${DIGEST}" >> "$GITHUB_OUTPUT"
        echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
    - name: Cache osv-scanner binary
      id: cache-osv
      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: /usr/local/bin/osv-scanner
        key: osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
        restore-keys: |
          osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
    - name: Download and install osv-scanner
      if: steps.cache-osv.outputs.cache-hit != 'true'
      shell: bash
      run: |
        set -euo pipefail

        VERSION="${{ steps.arch.outputs.version }}"
        ARCH="${{ steps.arch.outputs.arch }}"
        EXPECTED_DIGEST="${{ steps.arch.outputs.digest }}"
        DEST="/usr/local/bin/osv-scanner"

        mkdir -p /usr/local/bin

        curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "${DEST}"

        ACTUAL_DIGEST=$(sha256sum "${DEST}" | awk '{print $1}')
        if [ "${ACTUAL_DIGEST}" != "${EXPECTED_DIGEST}" ]; then
          echo "Digest mismatch for osv-scanner ${VERSION} (linux_${ARCH})" >&2
          echo "  expected: ${EXPECTED_DIGEST}" >&2
          echo "  actual:   ${ACTUAL_DIGEST}" >&2
          rm -f "${DEST}"
          exit 1
        fi

        chmod +x "${DEST}"
        echo "Verified osv-scanner ${VERSION} (linux_${ARCH}) digest ${ACTUAL_DIGEST}"

    - name: Add osv-scanner to PATH
      shell: bash
      run: |
        echo "/usr/local/bin" >> "$GITHUB_PATH"