_scheduled-audit.yml

name: "> Scheduled Audit"

on:
  workflow_call:
    secrets:
      BETTERSTACK_AUDIT_HEARTBEAT_URL:
        required: false

jobs:
  audit-scheduled:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Setup Dev Environment
        uses: ./.github/actions/setup-dev-env

      - name: Audit
        shell: bash
        env:
          BETTERSTACK_AUDIT_HEARTBEAT_URL: "${{ secrets.BETTERSTACK_AUDIT_HEARTBEAT_URL }}"
        run: |
          set +e
          mise run audit
          EXIT_CODE=$?
          # Provide heartbeat to BetterStack for monitoring/alerting if heartbeat url is configured as secret
          if [ -n "$BETTERSTACK_AUDIT_HEARTBEAT_URL" ]; then
            BETTERSTACK_METADATA_PAYLOAD=$(jq -n \
              --arg github_workflow "${{ github.workflow }}" \
              --arg github_run_url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
              --arg github_run_id "${{ github.run_id }}" \
              --arg github_job "${{ github.job }}" \
              --arg github_sha "${{ github.sha }}" \
              --arg github_actor "${{ github.actor }}" \
              --arg github_repository "${{ github.repository }}" \
              --arg github_ref "${{ github.ref }}" \
              --arg job_status "${{ job.status }}" \
              --arg github_event_name "${{ github.event_name }}" \
              --arg timestamp "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
              '{
                github: {
                  workflow: $github_workflow,
                  run_url: $github_run_url,
                  run_id: $github_run_id,
                  job: $github_job,
                  sha: $github_sha,
                  actor: $github_actor,
                  repository: $github_repository,
                  ref: $github_ref,
                  event_name: $github_event_name
                },
                job: {
                  status: $job_status,
                },
                timestamp: $timestamp,
              }'
            )
            curl \
              --fail-with-body \
              --silent \
              --request POST \
              --header "Content-Type: application/json" \
              --data-binary "${BETTERSTACK_METADATA_PAYLOAD}" \
              "${BETTERSTACK_AUDIT_HEARTBEAT_URL}/${EXIT_CODE}"
            echo "INFO: Sent heartbeat to betterstack with exit code '${EXIT_CODE}'"
          else
            echo "WARNING: No BetterStack heartbeat URL configured, skipped heartbeat notification."
          fi
          exit $EXIT_CODE

      - name: Upload audit results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: ${{ always() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
        with:
          name: audit-results-scheduled
          path: |
            reports/sbom.json
            reports/sbom.spdx
            reports/licenses.csv
            reports/licenses.json
            reports/licenses_grouped.json
            reports/vulnerabilities.json
          retention-days: 7