rl-scanner.yml

name: RL-Secure Workflow
run-name: rl-scanner-only

on:
  merge_group:
  workflow_dispatch:
  push:
    branches: ["main"]
  pull_request:
    types:
      - opened
      - synchronize

jobs:
  checkout-build-scan-only:
    runs-on: ubuntu-latest

    environment: security

    permissions:
      pull-requests: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 8

      - name: Build with Gradle
        uses: gradle/gradle-build-action@4c39dd82cd5e1ec7c6fa0173bb41b4b6bb3b86ff
        with:
          arguments: assemble apiDiff check jacocoTestReport --continue --console=plain

      - name: Get Artifact Version
        id: get_version
        run: echo "::set-output name=version::$(cat .version)"

      - name: List build/libs contents
        run: ls -la build/libs

      - name: Output build artifact
        id: output_build_artifact
        run: |
          echo "scanfile=build/libs/auth0-0.0.1-SNAPSHOT.jar" >> $GITHUB_OUTPUT

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.9"

      - name: Install Python dependencies
        run: |
          pip install --upgrade pip
          pip install -r scripts/requirements.txt

      - name: Run Reversing Labs Wrapper Scanner
        env:
          RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
          RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
          SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
        run: |
          python scripts/rl-wrapper.py \
            --artifact "$(pwd)/${{ steps.output_build_artifact.outputs.scanfile }}" \
            --name "${{ github.event.repository.name }}" \
            --version "${{ steps.get_version.outputs.version }}" \
            --repository "${{ github.repository }}" \
            --commit "${{ github.sha }}" \
            --build-env "github_action"
        continue-on-error: true