security-audit.yml

name: "Security Audit"

on:
  push:
  schedule:
    - cron: '0 6 * * *'

jobs:

  grype:
    name: Grype
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        image:
          # Develop
          - dswbot/wizard-server:develop
          - dswbot/wizard-client:develop
          - dswbot/document-worker:develop
          - dswbot/mailer:develop
          # Maintained
          - datastewardshipwizard/wizard-server:4.12
          - datastewardshipwizard/wizard-client:4.12
          - datastewardshipwizard/document-worker:4.12
          - datastewardshipwizard/mailer:4.12
          # Latest
          - datastewardshipwizard/wizard-server:4.13
          - datastewardshipwizard/wizard-client:4.13
          - datastewardshipwizard/document-worker:4.13
          - datastewardshipwizard/mailer:4.13

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Install Grype
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin

      - name: Check Grype
        run: |
          grype version

      - name: Run Grype
        run: |
          grype ${{ matrix.image }} | tee result.txt
      
      - name: Check critical vulnerabilities
        run: |
          CRITICALS=$(cat result.txt | grep "Critical" | wc -l | tr -s " ")
          if [ "$CRITICALS" -gt "0" ]; then
            echo "There are critical vulnerabilities: $CRITICALS (image: $IMAGE)"
            echo "--------------------------------------------------------------------------------"
            cat result.txt | grep "Critical"
            echo "--------------------------------------------------------------------------------"
            echo "Sending notification..."
            ./.github/scripts/discord-notify-error.sh "$DISCORD_ERROR_WEBHOOK_URL" "$IMAGE" "$CRITICALS" "$REPO" "$RUN"
            ./.github/scripts/discord-notify-error.sh "$DISCORD_INFO_WEBHOOK_URL" "$IMAGE" "$CRITICALS" "$REPO" "$RUN"
            exit 1
          else
            echo "There are no critical vulnerabilities for image: $IMAGE"
            echo "Sending notification..."
            ./.github/scripts/discord-notify-info.sh "$DISCORD_INFO_WEBHOOK_URL" "$IMAGE" "$REPO" "$RUN"
            echo "Well done!"
          fi
        env:
          IMAGE: ${{ matrix.image }}
          DISCORD_ERROR_WEBHOOK_URL: ${{ secrets.DISCORD_ERROR_WEBHOOK_URL }}
          DISCORD_INFO_WEBHOOK_URL: ${{ secrets.DISCORD_INFO_WEBHOOK_URL }}
          REPO: ${{ github.repository }}
          RUN: ${{ github.run_id }}