neiam /gitgud

name: audit
# Known vulnerabilities in what the forge is built from: every lockfile
# in the repository (mix.lock, the CLI's and the NIFs' Cargo.lock)
# checked against the OSV database (https://osv.dev). A finding fails
# the run, which is how it gets noticed — the CI page, the panel widget,
# `gg ci list`. Nightly, since advisories land without anyone pushing,
# and by hand from the Actions page.
#
# The Android app isn't covered: osv-scanner reads Gradle lockfiles,
# and the app has a version catalog (gradle/libs.versions.toml) only.
on:
  schedule:
    - cron: "17 6 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  osv:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4

      # Pinned, and checked against the release's published checksum
      # before it runs: a scanner is a strange thing to take on trust.
      # To move it on, change both together, from
      # https://github.com/google/osv-scanner/releases (…_SHA256SUMS).
      - name: Fetch osv-scanner
        env:
          OSV_VERSION: v2.6.0
          OSV_SHA256: ca69b3d3cd08f889a49dc0a383122f71cc528b83803671df5fd874d97485b108
        run: |
          curl -sSfL -o /tmp/osv-scanner \
            "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_amd64"
          echo "${OSV_SHA256}  /tmp/osv-scanner" | sha256sum -c -
          chmod +x /tmp/osv-scanner

      # Exit 1 when anything is vulnerable, so the run fails; the table
      # names each package, its version, and the version that fixes it.
      - name: Scan the lockfiles
        run: /tmp/osv-scanner scan source --recursive .