.reusable-compliance.yml

name: compliance

permissions: read-all

on:
  workflow_call:
    inputs:
      skip:
        description: "Want to skip running certain jobs 'none', 'non-required', 'all'?"
        type: string
        default: "none"

jobs:
  ossf-scorecard:
    runs-on: ubuntu-latest
    if: |
      (github.ref_name == 'main' || github.event_name == 'pull_request') &&
      inputs.skip != 'non-required' &&
      inputs.skip != 'all'
    permissions:
      pull-requests: write
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          persist-credentials: false
      - name: Analyze
        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
        with:
          results_file: results.sarif
          results_format: sarif
          repo_token: ${{ secrets.SCORECARD_TOKEN }}
          publish_results: false  #TODO: reactivate when working again
      - name: Upload
        uses: github/codeql-action/upload-sarif@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15
        with:
          sarif_file: results.sarif

  dependency-review:
    name: dependency review
    runs-on: ubuntu-latest
    if: |
      github.event_name == 'pull_request' &&
      inputs.skip != 'non-required' &&
      inputs.skip != 'all'
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - name: Review
        uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4
        with:
          comment-summary-in-pr: always

  check-commit-message:
    runs-on: ubuntu-latest
    if: |
      github.event_name == 'pull_request' &&
      inputs.skip != 'all'
    permissions: {}
    steps:
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ github.event.pull_request.head.sha }} # Otherwise will checkout merge commit, which isn't conform
          fetch-depth: ${{ github.event.pull_request.commits }} # Fetch all commits of the MR, but only those
      - name: Check commit messages for conformity
        run: |
          echo "Commits between dev branch and current SHA:"
          COMMITS=$(git log --pretty=%H)
          echo "${COMMITS}"
          EXIT=0
          COMMIT_MSGS=$(git log --pretty=%s) # show subject only
          for commit in ${COMMITS}; do
              MSG=$(git log ${commit} -n1 --pretty=%s)
              TYPE=$(echo ${MSG} | awk '{{ print $1 }}')
              if ! [[ "${TYPE}" =~ ^(build|build\(deps\)|ci|docs|feat|fix|refactor|test|update):$ ]]; then
                EXIT=1
                echo "Commit message of commit ${commit} doesn't conform to 'type: msg' format:"
                echo "${MSG}"
                echo "-------------------------"
              fi
          done
          exit ${EXIT}