vulnetix-scanners.yml

# Managed by `vulnetix gha setup`.
# Re-run `vulnetix gha setup <tool>` to add a scanner; edits here are overwritten.
#
# Each scanner runs independently and uploads its report as a workflow
# artifact. The publish job then hands every artifact to Vulnetix in one go,
# attributed to the tool that produced it.

name: Third-Party Scanners

on:
  schedule:
    - cron: '47 11 * * 3'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  bandit:
    name: Bandit (Python SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Bandit
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -name '*.py' -print | head -n 1 | grep -q .; then
            echo '::notice::no Python files found; skipping Bandit'
            exit 0
          fi
          uvx --from 'bandit[sarif]' bandit -r . -f sarif -o bandit.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' bandit.sarif >/dev/null 2>&1; then
            echo '::warning::bandit produced no valid SARIF; dropping the artifact'
            rm -f bandit.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: bandit
          path: bandit.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  bearer:
    name: Bearer (SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run Bearer
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b "$HOME/.local/bin" >/dev/null 2>&1 || true
          export PATH="$HOME/.local/bin:$PATH"
          if ! command -v bearer >/dev/null 2>&1; then
            echo '::warning::bearer could not be installed on this runner; skipping'
            exit 0
          fi
          # --exit-code 0 because a finding is a successful scan, not a broken one.
          bearer scan . --format sarif --output bearer.sarif --exit-code 0 --quiet 2>bearer.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' bearer.sarif >/dev/null 2>&1; then
            echo '::warning::bearer produced no valid SARIF; dropping the artifact'
            rm -f bearer.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: bearer
          path: bearer.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  brakeman:
    name: Brakeman (Ruby on Rails SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Ruby
        continue-on-error: true
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ruby
      - name: Run Brakeman
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Gemfile ] || ! grep -E 'rails|railties' Gemfile Gemfile.lock >/dev/null 2>&1; then
            echo '::notice::no Rails app detected; skipping Brakeman'
            exit 0
          fi
          gem install brakeman
          brakeman -f sarif -o brakeman.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' brakeman.sarif >/dev/null 2>&1; then
            echo '::warning::brakeman produced no valid SARIF; dropping the artifact'
            rm -f brakeman.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: brakeman
          path: brakeman.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  cdxgen:
    name: cdxgen (multi-ecosystem SBOM)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node.js
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Run cdxgen
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! find . -maxdepth 4 -type f \( -name package-lock.json -o -name go.mod -o -name requirements.txt -o -name pyproject.toml -o -name pom.xml -o -name build.gradle -o -name Cargo.lock -o -name composer.lock -o -name Gemfile.lock -o -name '*.csproj' \) -print | head -n 1 | grep -q .; then
            echo '::notice::no supported package manifest found; skipping cdxgen'
            exit 0
          fi
          npx --yes @cyclonedx/cdxgen -o cdxgen.cdx.json . || true
          if ! jq -e '.bomFormat == "CycloneDX"' cdxgen.cdx.json >/dev/null 2>&1; then
            echo '::warning::cdxgen produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cdxgen.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cdxgen
          path: cdxgen.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  checkov:
    name: Checkov (IaC)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Checkov
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          uvx --from checkov checkov -d . -o sarif --output-file-path . --soft-fail || true
      - uses: actions/upload-artifact@v6
        with:
          name: checkov
          path: results.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  clippy:
    name: Rust Clippy (SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run Clippy
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          rustup component add clippy
          cargo install clippy-sarif sarif-fmt
          # cargo clippy exits non-zero when it emits warnings, which is a successful run.
          cargo clippy --all-targets --all-features --message-format=json \
            | clippy-sarif >clippy.sarif 2>clippy.stderr
          if ! jq -e '.version and (.runs | type == "array")' clippy.sarif >/dev/null 2>&1; then
            echo "::warning::clippy produced no valid SARIF; dropping the artifact"
            sed -n '1,20p' clippy.stderr
            rm -f clippy.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: clippy
          path: clippy.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  cppcheck:
    name: Cppcheck (C/C++ SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run Cppcheck
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! find . -path ./.git -prune -o -type f -print | grep -E '\.(c|cc|cpp|h|hpp)$' | head -n 1 | grep -q .; then
            echo '::notice::no C/C++ files found; skipping Cppcheck'
            exit 0
          fi
          # Resolve how to become root, or do without it.
          #
          # The AWS runner pools grant exactly one sudo rule — writing the busy/idle
          # heartbeat — because general NOPASSWD sudo would hand the instance role to
          # every workflow on the box through IMDS. A blind `sudo` there does not fail
          # with "permission denied": it blocks on a password prompt and dies with
          # "sudo: a terminal is required to read the password".
          SUDO=""
          if [ "$(id -u)" -ne 0 ]; then
            if sudo -n true 2>/dev/null; then
              SUDO="sudo -n"
            fi
          fi
          if [ -n "$SUDO" ] || [ "$(id -u)" -eq 0 ]; then
            if command -v apt-get >/dev/null 2>&1; then
              $SUDO apt-get update -qq && $SUDO apt-get install -y -qq cppcheck || true
            elif command -v dnf >/dev/null 2>&1; then
              $SUDO dnf install -y -q cppcheck || true
            elif command -v apk >/dev/null 2>&1; then
              $SUDO apk add --no-cache cppcheck || true
            fi
          fi
          if ! command -v cppcheck >/dev/null 2>&1; then
            echo '::warning::cppcheck could not be installed on this runner; skipping'
            exit 0
          fi
          cppcheck --enable=warning,style,performance,portability --output-format=sarif --output-file=cppcheck.sarif . || true
          if ! jq -e '.version and (.runs | type == "array")' cppcheck.sarif >/dev/null 2>&1; then
            echo '::warning::cppcheck produced no valid SARIF; dropping the artifact'
            rm -f cppcheck.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cppcheck
          path: cppcheck.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  cyclonedx-go:
    name: CycloneDX Go SBOM
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Generate Go CycloneDX SBOM
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ ! -f go.mod ]; then
            echo '::notice::no go.mod found; skipping CycloneDX Go'
            exit 0
          fi
          go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
          cyclonedx-gomod app -json -output cyclonedx-go.cdx.json . || true
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-go.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx go produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-go.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-go
          path: cyclonedx-go.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  cyclonedx-maven:
    name: CycloneDX Maven (SBOM)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Java
        continue-on-error: true
        uses: actions/setup-java@v4
        with:
          cache: maven
          distribution: temurin
          java-version: 17
      - name: Generate Maven CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if [ ! -f pom.xml ]; then
            echo '::notice::no pom.xml found; skipping CycloneDX Maven'
            exit 0
          fi
          mvn -B -q org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeAggregateBom \
            -DoutputFormat=json -DoutputName=cyclonedx-maven 2>cyclonedx-maven.stderr || true
          found=$(find . -name 'cyclonedx-maven.json' -print -quit)
          if [ -n "$found" ]; then
            cp "$found" cyclonedx-maven.cdx.json
          fi
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-maven.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx maven produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-maven.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-maven
          path: cyclonedx-maven.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  cyclonedx-node:
    name: CycloneDX npm SBOM
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node.js
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Generate npm CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f package-lock.json ]; then
            echo '::notice::no package-lock.json found; skipping CycloneDX npm'
            exit 0
          fi
          npm ci
          npx --yes @cyclonedx/cyclonedx-npm --omit dev --flatten-components --output-format JSON --output-file cyclonedx-node.cdx.json || true
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-node.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx npm produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-node.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-node
          path: cyclonedx-node.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  cyclonedx-php:
    name: CycloneDX PHP SBOM
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v5
      - name: Detect PHP setup capability
        id: php-setup
        shell: bash --noprofile --norc {0}
        run: |
          # shivammathur/setup-php shells out to sudo. The runner pools grant one
          # narrow sudo rule, so on those runners the action blocks forever on a
          # password prompt and the job dies at its timeout-minutes cap having done
          # nothing. Only run it where sudo is non-interactive.
          if sudo -n true >/dev/null 2>&1; then
            echo 'run=true' >>"$GITHUB_OUTPUT"
          else
            echo 'run=false' >>"$GITHUB_OUTPUT"
            echo '::notice::passwordless sudo is unavailable on this runner; using the PHP already installed'
          fi
      - name: Set up PHP
        if: steps.php-setup.outputs.run == 'true'
        continue-on-error: true
        timeout-minutes: 5
        uses: shivammathur/setup-php@v2
        with:
          php-version: 8.2
          tools: composer
      - name: Generate PHP CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f composer.lock ]; then
            echo '::notice::no composer.lock found; skipping CycloneDX PHP'
            exit 0
          fi
          composer require --dev cyclonedx/cyclonedx-php-composer || true
          composer CycloneDX:make-sbom --output-format=JSON --output-file=cyclonedx-php.cdx.json || true
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-php.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx php produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-php.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-php
          path: cyclonedx-php.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  cyclonedx-ruby:
    name: CycloneDX Ruby SBOM
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Ruby
        continue-on-error: true
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ruby
      - name: Generate Ruby CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Gemfile.lock ]; then
            echo '::notice::no Gemfile.lock found; skipping CycloneDX Ruby'
            exit 0
          fi
          gem install cyclonedx-ruby
          cyclonedx-ruby --path . --output cyclonedx-ruby.cdx.json --format JSON || true
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-ruby.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx ruby produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-ruby.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-ruby
          path: cyclonedx-ruby.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  cyclonedx-rust:
    name: CycloneDX Rust SBOM
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Generate Rust CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Cargo.lock ] && [ ! -f Cargo.toml ]; then
            echo '::notice::no Cargo project found; skipping CycloneDX Rust'
            exit 0
          fi
          cargo install cargo-cyclonedx
          cargo cyclonedx --format json --output-cdx cyclonedx-rust.cdx.json || true
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-rust.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx rust produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-rust.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-rust
          path: cyclonedx-rust.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  detect-secrets:
    name: detect-secrets (secrets)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run detect-secrets
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          # The converter below runs under uv rather than whatever `python3` happens to
          # be on the runner. uv carries its own interpreter, so the script runs the same
          # way on every image, cannot be broken by a system Python that is missing or
          # externally managed, and cannot install anything into one.
          if ! command -v uv >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uv >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; cannot convert the report'
            exit 0
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          if [ -f .secrets.baseline ]; then
            uvx --from detect-secrets detect-secrets scan --baseline .secrets.baseline >detect-secrets-results.json || true
          else
            uvx --from detect-secrets detect-secrets scan --all-files >detect-secrets-results.json || true
          fi
          uv run --no-project --python 3.12 python - <<'PY'
          import json
          import os

          sarif = {
              "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
              "version": "2.1.0",
              "runs": [{
                  "tool": {
                      "driver": {
                          "name": "detect-secrets",
                          "informationUri": "https://github.com/Yelp/detect-secrets",
                          "rules": [],
                      }
                  },
                  "results": [],
              }],
          }
          rules_seen = set()

          def to_int(value):
              try:
                  return max(1, int(value))
              except (TypeError, ValueError):
                  return 1

          def add_rule(rule_id, plugin_name):
              if rule_id in rules_seen:
                  return
              sarif["runs"][0]["tool"]["driver"]["rules"].append({
                  "id": rule_id,
                  "shortDescription": {"text": f"Potential leaked credential detected ({plugin_name})"},
                  "defaultConfiguration": {"level": "error"},
              })
              rules_seen.add(rule_id)

          if os.path.exists("detect-secrets-results.json") and os.path.getsize("detect-secrets-results.json") > 0:
              with open("detect-secrets-results.json", "r", encoding="utf-8") as fh:
                  data = json.load(fh)
              results = data.get("results") or {}
              for file_path, findings in results.items():
                  for finding in findings:
                      plugin_name = str(finding.get("type") or "detect-secrets")
                      rule_id = plugin_name.replace(" ", "-") or "detect-secrets"
                      add_rule(rule_id, plugin_name)
                      hashed_secret = finding.get("hashed_secret")
                      message = f"Potential secret exposed. Type: {plugin_name}."
                      if hashed_secret:
                          message += f" Hashed representation: {hashed_secret}"
                      sarif["runs"][0]["results"].append({
                          "ruleId": rule_id,
                          "level": "error",
                          "message": {"text": message},
                          "locations": [{
                              "physicalLocation": {
                                  "artifactLocation": {"uri": file_path},
                                  "region": {"startLine": to_int(finding.get("line_number"))},
                              }
                          }],
                      })

          with open("detect-secrets-results.sarif", "w", encoding="utf-8") as fh:
              json.dump(sarif, fh, indent=2)
          PY
          if ! jq -e '.version and (.runs | type == "array")' detect-secrets-results.sarif >/dev/null 2>&1; then
            echo '::warning::detect-secrets produced no valid SARIF; dropping the artifact'
            rm -f detect-secrets-results.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: detect-secrets
          path: detect-secrets-results.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  detekt:
    name: detekt (Kotlin SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Java
        continue-on-error: true
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
      - name: Run detekt
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if ! find . -path ./.git -prune -o -type f -name '*.kt' -print | head -n 1 | grep -q .; then
            echo '::notice::no Kotlin files found; skipping detekt'
            exit 0
          fi
          version=1.23.8
          curl -fsSL -o detekt-cli.zip "https://github.com/detekt/detekt/releases/download/v${version}/detekt-cli-${version}.zip" || true
          if [ ! -s detekt-cli.zip ]; then
            echo '::warning::could not download detekt; skipping'
            exit 0
          fi
          unzip -q -o detekt-cli.zip
          # detekt exits 2 when it reports issues, which is a successful run.
          "detekt-cli-${version}/bin/detekt-cli" --input . --report sarif:detekt.sarif 2>detekt.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' detekt.sarif >/dev/null 2>&1; then
            echo '::warning::detekt produced no valid SARIF; dropping the artifact'
            rm -f detekt.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: detekt
          path: detekt.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  dockle:
    name: Dockle (container image)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run Dockle
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ ! -f Dockerfile ] && [ ! -f Containerfile ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping Dockle'
            exit 0
          fi
          dockerfile=Dockerfile
          if [ -f Containerfile ]; then
            dockerfile=Containerfile
          fi
          image="vulnetix-dockle:${GITHUB_SHA:-local}"
          docker build -f "$dockerfile" -t "$image" .
          go install github.com/goodwithtech/dockle/cmd/dockle@latest
          dockle --format sarif --output dockle.sarif "$image" || true
          if ! jq -e '.version and (.runs | type == "array")' dockle.sarif >/dev/null 2>&1; then
            echo '::warning::dockle produced no valid SARIF; dropping the artifact'
            rm -f dockle.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: dockle
          path: dockle.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  eslint:
    name: ESLint (JavaScript lint)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node.js
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Run ESLint
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f package.json ]; then
            echo '::notice::no package.json found; skipping ESLint'
            exit 0
          fi
          if ! ls eslint.config.* .eslintrc .eslintrc.* >/dev/null 2>&1; then
            echo '::notice::no ESLint config found; skipping ESLint'
            exit 0
          fi
          if [ -f package-lock.json ]; then
            npm ci
          else
            npm install --no-audit --no-fund
          fi
          npm install --no-audit --no-fund --no-save @microsoft/eslint-formatter-sarif
          npx eslint -f @microsoft/eslint-formatter-sarif -o eslint.sarif . || true
          if ! jq -e '.version and (.runs | type == "array")' eslint.sarif >/dev/null 2>&1; then
            echo '::warning::eslint produced no valid SARIF; dropping the artifact'
            rm -f eslint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: eslint
          path: eslint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  flawfinder:
    name: Flawfinder (C/C++ SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Flawfinder
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -print | grep -E '\.(c|cc|cpp|h|hpp)$' | head -n 1 | grep -q .; then
            echo '::notice::no C/C++ files found; skipping Flawfinder'
            exit 0
          fi
          uvx --from flawfinder flawfinder --sarif . >flawfinder.sarif 2>flawfinder.stderr
          rc=$?
          if [ $rc -ne 0 ] && [ $rc -ne 1 ]; then
            echo "::warning::flawfinder exited $rc"
            sed -n '1,20p' flawfinder.stderr
          fi
          if ! jq -e '.version and (.runs | type == "array")' flawfinder.sarif >/dev/null 2>&1; then
            echo '::warning::flawfinder produced no valid SARIF; dropping the artifact'
            rm -f flawfinder.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: flawfinder
          path: flawfinder.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  github-sbom:
    name: GitHub SBOM (SPDX)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Export the dependency graph
        continue-on-error: true
        env:
          GH_TOKEN: '${{ github.token }}'
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          # 404 when the dependency graph is disabled for the repository, which is a
          # setting rather than a failure.
          if ! gh api "repos/${GITHUB_REPOSITORY}/dependency-graph/sbom" --jq '.sbom' >github-sbom.spdx.json 2>github-sbom.stderr; then
            echo '::notice::the dependency graph is not available for this repository; skipping'
            rm -f github-sbom.spdx.json
            exit 0
          fi
          if ! jq -e '.spdxVersion' github-sbom.spdx.json >/dev/null 2>&1; then
            echo '::warning::GitHub returned no valid SPDX; dropping the artifact'
            rm -f github-sbom.spdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: github-sbom
          path: github-sbom.spdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  gitleaks:
    name: Gitleaks (Secrets)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run Gitleaks
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          # Gitleaks exits 1 when it finds leaks, which is a successful scan.
          docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:v8.24.0 \
            detect --source /repo --report-format sarif --report-path /repo/gitleaks.sarif --no-git || true
          if ! jq -e '.version and (.runs | type == "array")' gitleaks.sarif >/dev/null 2>&1; then
            echo "::warning::gitleaks produced no valid SARIF; dropping the artifact"
            rm -f gitleaks.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: gitleaks
          path: gitleaks.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  golangci-lint:
    name: golangci-lint (Go lint)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run golangci-lint
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ ! -f go.mod ]; then
            echo '::notice::no go.mod found; skipping golangci-lint'
            exit 0
          fi
          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
          golangci-lint run --output.sarif.path=golangci-lint.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' golangci-lint.sarif >/dev/null 2>&1; then
            echo '::warning::golangci-lint produced no valid SARIF; dropping the artifact'
            rm -f golangci-lint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: golangci-lint
          path: golangci-lint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  gosec:
    name: gosec (Go SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run gosec
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ ! -f go.mod ]; then
            echo '::notice::no go.mod found; skipping gosec'
            exit 0
          fi
          go install github.com/securego/gosec/v2/cmd/gosec@v2.28.0
          gosec -no-fail -fmt sarif -out gosec.sarif ./... || true
          if ! jq -e '.version and (.runs | type == "array")' gosec.sarif >/dev/null 2>&1; then
            echo '::warning::gosec produced no valid SARIF; dropping the artifact'
            rm -f gosec.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: gosec
          path: gosec.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  govulncheck:
    name: govulncheck (Go SCA)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run govulncheck
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ ! -f go.mod ]; then
            echo '::notice::no go.mod found; skipping govulncheck'
            exit 0
          fi
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck -format sarif ./... >govulncheck.sarif 2>govulncheck.stderr
          rc=$?
          if [ $rc -ne 0 ]; then
            echo "::warning::govulncheck exited $rc"
            sed -n '1,20p' govulncheck.stderr
          fi
          if ! jq -e '.version and (.runs | type == "array")' govulncheck.sarif >/dev/null 2>&1; then
            echo '::warning::govulncheck produced no valid SARIF; dropping the artifact'
            rm -f govulncheck.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: govulncheck
          path: govulncheck.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  grype:
    name: Grype (SCA)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run Grype
        id: grype
        continue-on-error: true
        uses: anchore/scan-action@v7
        with:
          fail-build: false
          output-format: sarif
          path: .
      - name: Stage Grype SARIF
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          cp "${{ steps.grype.outputs.sarif }}" grype.sarif
      - uses: actions/upload-artifact@v6
        with:
          name: grype
          path: grype.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  grype-image:
    name: Grype image (OCI)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Build the image
        id: build
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Dockerfile ] && [ ! -f Containerfile ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping'
            exit 0
          fi
          dockerfile=Dockerfile
          if [ -f Containerfile ]; then
            dockerfile=Containerfile
          fi
          image="vulnetix-scan:${GITHUB_SHA:-local}"
          if ! docker build -f "$dockerfile" -t "$image" . ; then
            echo '::warning::image build failed; nothing to scan'
            exit 0
          fi
          echo "image=$image" >> "$GITHUB_OUTPUT"
      - name: Run Grype
        id: grype
        continue-on-error: true
        uses: anchore/scan-action@v7
        with:
          fail-build: false
          image: '${{ steps.build.outputs.image }}'
          output-format: sarif
      - name: Stage Grype SARIF
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${{ steps.grype.outputs.sarif }}" ]; then
            cp "${{ steps.grype.outputs.sarif }}" grype-image.sarif || true
          fi
          if ! jq -e '.version and (.runs | type == "array")' grype-image.sarif >/dev/null 2>&1; then
            echo '::warning::grype image produced no valid SARIF; dropping the artifact'
            rm -f grype-image.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: grype-image
          path: grype-image.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  hadolint:
    name: Hadolint (Dockerfile)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    steps:
      - uses: actions/checkout@v5
      - name: Run Hadolint
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          dockerfile=""
          for candidate in Dockerfile Containerfile; do
            if [ -f "$candidate" ]; then
              dockerfile="$candidate"
              break
            fi
          done
          # A repository can keep its container file in a subdirectory; lint that one
          # rather than reporting nothing.
          if [ -z "$dockerfile" ]; then
            dockerfile="$(find . -path ./.git -prune -o -type f \( -name Dockerfile -o -name Containerfile \) -print 2>/dev/null | sed 's|^\./||' | sort | head -n 1)"
          fi
          if [ -z "$dockerfile" ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping hadolint'
            exit 0
          fi
          # Hadolint exits 1 when it finds lint issues, which is a successful scan.
          docker run --rm -v "$PWD:/repo" -w /repo hadolint/hadolint:v2.12.0 \
            hadolint --format sarif "$dockerfile" >hadolint.sarif 2>hadolint.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' hadolint.sarif >/dev/null 2>&1; then
            echo '::warning::hadolint produced no valid SARIF; dropping the artifact'
            rm -f hadolint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: hadolint
          path: hadolint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  kics:
    name: KICS (IaC)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run KICS
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          mkdir -p kics-out
          docker run --rm -v "$PWD:/path" checkmarx/kics:v2.1.20 \
            scan -p /path -o /path/kics-out --report-formats sarif --no-progress || true
      - uses: actions/upload-artifact@v6
        with:
          name: kics
          path: kics-out/results.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  mobsfscan:
    name: mobsfscan (Mobile SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run mobsfscan
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          set -uo pipefail
          # mobsfscan exits 1 when it reports findings.
          uvx --from mobsfscan mobsfscan --sarif -o mobsfscan.sarif . 2>mobsfscan.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' mobsfscan.sarif >/dev/null 2>&1; then
            echo '::warning::mobsfscan produced no valid SARIF; dropping the artifact'
            rm -f mobsfscan.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: mobsfscan
          path: mobsfscan.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  njsscan:
    name: njsscan (Node SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run njsscan
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -print | grep -E '\.(js|jsx|ts|tsx)$' | head -n 1 | grep -q .; then
            echo '::notice::no JavaScript or TypeScript files found; skipping njsscan'
            exit 0
          fi
          uvx --from njsscan njsscan --sarif -o njsscan.sarif . || true
          if ! jq -e '.version and (.runs | type == "array")' njsscan.sarif >/dev/null 2>&1; then
            echo '::warning::njsscan produced no valid SARIF; dropping the artifact'
            rm -f njsscan.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: njsscan
          path: njsscan.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  noseyparker:
    name: Nosey Parker (secrets)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run Nosey Parker
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          version=0.24.0
          url="https://github.com/praetorian-inc/noseyparker/releases/download/v${version}/noseyparker-v${version}-x86_64-unknown-linux-gnu.tar.gz"
          mkdir -p /tmp/np
          curl -fsSL "$url" | tar -xz -C /tmp/np 2>/dev/null || true
          bin=$(find /tmp/np -type f -name noseyparker -perm -u+x -print -quit 2>/dev/null)
          if [ -z "$bin" ]; then
            echo '::warning::noseyparker could not be installed on this runner; skipping'
            exit 0
          fi
          "$bin" scan --datastore np.datastore . >/dev/null 2>noseyparker.stderr || true
          "$bin" report --datastore np.datastore --format sarif --output noseyparker.sarif >/dev/null 2>>noseyparker.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' noseyparker.sarif >/dev/null 2>&1; then
            echo '::warning::noseyparker produced no valid SARIF; dropping the artifact'
            rm -f noseyparker.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: noseyparker
          path: noseyparker.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  npm-audit:
    name: npm audit (Node SCA)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node.js
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Run npm audit
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f package-lock.json ]; then
            echo '::notice::no package-lock.json found; skipping npm audit'
            exit 0
          fi
          npm ci
          npm audit --json >npm-audit.json || true
          npx --yes npm-audit-sarif -i npm-audit.json -o npm-audit.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' npm-audit.sarif >/dev/null 2>&1; then
            echo '::warning::npm audit produced no valid SARIF; dropping the artifact'
            rm -f npm-audit.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: npm-audit
          path: npm-audit.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  opengrep:
    name: OpenGrep (SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run OpenGrep
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash >/dev/null 2>&1 || true
          export PATH="$HOME/.opengrep/cli/latest:$HOME/.local/bin:$PATH"
          if ! command -v opengrep >/dev/null 2>&1; then
            echo '::warning::opengrep could not be installed on this runner; skipping'
            exit 0
          fi
          # The CLI tracks Semgrep's flags, but the SARIF flag was renamed between
          # releases. Try the current spelling, then the older one.
          opengrep scan --config auto --sarif --output opengrep.sarif . >/dev/null 2>opengrep.stderr \
            || opengrep scan --config auto --sarif-output=opengrep.sarif . >/dev/null 2>>opengrep.stderr \
            || true
          if ! jq -e '.version and (.runs | type == "array")' opengrep.sarif >/dev/null 2>&1; then
            echo '::warning::opengrep produced no valid SARIF; dropping the artifact'
            rm -f opengrep.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: opengrep
          path: opengrep.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  osv-scanner:
    name: OSV-Scanner (SCA)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run OSV-Scanner
        continue-on-error: true
        uses: google/osv-scanner-action/osv-scanner-action@v2.3.8
        with:
          scan-args: |-
            --format=sarif
            --output=osv.sarif
            ./
      - uses: actions/upload-artifact@v6
        with:
          name: osv-scanner
          path: osv.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  owasp-dependency-check:
    name: OWASP Dependency-Check (SCA)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 330
    steps:
      - uses: actions/checkout@v5
      - name: Set up Java
        continue-on-error: true
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
      - name: Restore the NVD database
        continue-on-error: true
        uses: actions/cache@v4
        with:
          key: 'dependency-check-nvd-${{ github.run_id }}'
          path: '${{ runner.temp }}/dependency-check-data'
          restore-keys: dependency-check-nvd-
      - name: Run OWASP Dependency-Check
        continue-on-error: true
        env:
          NVD_API_KEY: '${{ secrets.NVD_API_KEY }}'
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          version=$(curl -fsSL https://api.github.com/repos/jeremylong/DependencyCheck/releases/latest | jq -r '.tag_name | ltrimstr("v")')
          curl -fsSL "https://github.com/jeremylong/DependencyCheck/releases/download/v${version}/dependency-check-${version}-release.zip" -o dependency-check.zip
          unzip -q dependency-check.zip
          data_dir="${RUNNER_TEMP:-$PWD}/dependency-check-data"
          mkdir -p dependency-check-out "$data_dir"
          # --data points at the cached NVD database, kept outside the working tree so it
          # is not itself scanned. On an ephemeral runner with no cache Dependency-Check
          # downloads the whole of the NVD before it scans anything, which is a five-hour
          # job on its own; with the previous run's copy restored it applies the delta.
          args=(--scan . --format SARIF --out dependency-check-out --data "$data_dir")
          if [ -n "${NVD_API_KEY:-}" ]; then
            args+=(--nvdApiKey "$NVD_API_KEY")
          fi
          dependency-check/bin/dependency-check.sh "${args[@]}" || true
          found=$(find dependency-check-out -name '*.sarif' -print -quit)
          if [ -n "$found" ]; then
            cp "$found" dependency-check.sarif
          fi
          if ! jq -e '.version and (.runs | type == "array")' dependency-check.sarif >/dev/null 2>&1; then
            echo '::warning::dependency-check produced no valid SARIF; dropping the artifact'
            rm -f dependency-check.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: dependency-check
          path: dependency-check.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  pmd:
    name: PMD (Java SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run PMD
        continue-on-error: true
        uses: pmd/pmd-github-action@v2
        with:
          analyzeModifiedFilesOnly: false
          rulesets: rulesets/java/quickstart.xml
          version: latest
      - uses: actions/upload-artifact@v6
        with:
          name: pmd
          path: pmd-report.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  psalm:
    name: Psalm (PHP SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v5
      - name: Detect PHP setup capability
        id: php-setup
        shell: bash --noprofile --norc {0}
        run: |
          # shivammathur/setup-php shells out to sudo. The runner pools grant one
          # narrow sudo rule, so on those runners the action blocks forever on a
          # password prompt and the job dies at its timeout-minutes cap having done
          # nothing. Only run it where sudo is non-interactive.
          if sudo -n true >/dev/null 2>&1; then
            echo 'run=true' >>"$GITHUB_OUTPUT"
          else
            echo 'run=false' >>"$GITHUB_OUTPUT"
            echo '::notice::passwordless sudo is unavailable on this runner; using the PHP already installed'
          fi
      - name: Set up PHP
        if: steps.php-setup.outputs.run == 'true'
        continue-on-error: true
        timeout-minutes: 5
        uses: shivammathur/setup-php@v2
        with:
          coverage: none
          php-version: 8.3
      - name: Run Psalm
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if [ ! -f composer.json ]; then
            echo '::notice::no composer.json found; skipping Psalm'
            exit 0
          fi
          composer require --dev --no-interaction --quiet vimeo/psalm || true
          if [ ! -x vendor/bin/psalm ]; then
            echo '::warning::psalm could not be installed; skipping'
            exit 0
          fi
          if [ ! -f psalm.xml ] && [ ! -f psalm.xml.dist ]; then
            vendor/bin/psalm --init . 1 >/dev/null 2>&1 || true
          fi
          # Psalm exits non-zero when it reports issues.
          vendor/bin/psalm --no-cache --no-progress --report=psalm.sarif 2>psalm.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' psalm.sarif >/dev/null 2>&1; then
            echo '::warning::psalm produced no valid SARIF; dropping the artifact'
            rm -f psalm.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: psalm
          path: psalm.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  regula:
    name: Regula (IaC policy)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run Regula
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          version=3.2.1
          mkdir -p /tmp/regula
          curl -fsSL "https://github.com/fugue/regula/releases/download/v${version}/regula_${version}_Linux_x86_64.tar.gz" \
            | tar -xz -C /tmp/regula 2>/dev/null || true
          if [ ! -x /tmp/regula/regula ]; then
            echo '::warning::regula could not be installed on this runner; skipping'
            exit 0
          fi
          # Exit 1 means policy violations.
          /tmp/regula/regula run --format sarif . >regula.sarif 2>regula.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' regula.sarif >/dev/null 2>&1; then
            echo '::warning::regula produced no valid SARIF; dropping the artifact'
            rm -f regula.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: regula
          path: regula.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  retirejs:
    name: Retire.js (JavaScript SCA)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node.js
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Run Retire.js
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f package.json ] && ! find . -path ./.git -prune -o -type f -name '*.js' -print | head -n 1 | grep -q .; then
            echo '::notice::no JavaScript project detected; skipping Retire.js'
            exit 0
          fi
          npx --yes retire --outputformat cyclonedxJSON --outputpath retirejs.cdx.json --path . || true
          if ! jq -e '.bomFormat == "CycloneDX"' retirejs.cdx.json >/dev/null 2>&1; then
            echo '::warning::retirejs produced no valid CycloneDX JSON; dropping the artifact'
            rm -f retirejs.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: retirejs
          path: retirejs.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  rubocop:
    name: RuboCop (Ruby lint)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up Ruby
        continue-on-error: true
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ruby
      - name: Run RuboCop
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          # The converter below runs under uv rather than whatever `python3` happens to
          # be on the runner. uv carries its own interpreter, so the script runs the same
          # way on every image, cannot be broken by a system Python that is missing or
          # externally managed, and cannot install anything into one.
          if ! command -v uv >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uv >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; cannot convert the report'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -name '*.rb' -print | head -n 1 | grep -q .; then
            echo '::notice::no Ruby files found; skipping RuboCop'
            exit 0
          fi
          gem install rubocop
          rubocop --format github --out rubocop.github-actions.txt || true
          rubocop --format json --out rubocop.json || true
          uv run --no-project --python 3.12 python - <<'PY'
          import json
          import os

          sarif = {
              "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
              "version": "2.1.0",
              "runs": [{
                  "tool": {
                      "driver": {
                          "name": "RuboCop",
                          "informationUri": "https://github.com/rubocop/rubocop",
                          "rules": [],
                      }
                  },
                  "results": [],
              }],
          }
          rules_seen = set()
          severity_map = {
              "fatal": "error",
              "error": "error",
              "warning": "warning",
              "refactor": "warning",
              "convention": "note",
              "info": "note",
          }

          def to_int(value):
              try:
                  return max(1, int(value))
              except (TypeError, ValueError):
                  return 1

          def add_rule(rule_id):
              if rule_id in rules_seen:
                  return
              sarif["runs"][0]["tool"]["driver"]["rules"].append({
                  "id": rule_id,
                  "shortDescription": {"text": rule_id},
                  "defaultConfiguration": {"level": "warning"},
              })
              rules_seen.add(rule_id)

          if os.path.exists("rubocop.json") and os.path.getsize("rubocop.json") > 0:
              with open("rubocop.json", "r", encoding="utf-8") as fh:
                  data = json.load(fh)
              version = str((data.get("metadata") or {}).get("rubocop_version") or "")
              if version:
                  sarif["runs"][0]["tool"]["driver"]["version"] = version
              for file_info in data.get("files") or []:
                  path = str(file_info.get("path") or "unknown")
                  for offense in file_info.get("offenses") or []:
                      rule_id = str(offense.get("cop_name") or "RuboCop")
                      add_rule(rule_id)
                      location = offense.get("location") or {}
                      level = severity_map.get(str(offense.get("severity") or "").lower(), "warning")
                      result = {
                          "ruleId": rule_id,
                          "level": level,
                          "message": {"text": str(offense.get("message") or rule_id)},
                          "locations": [{
                              "physicalLocation": {
                                  "artifactLocation": {"uri": path},
                                  "region": {
                                      "startLine": to_int(location.get("start_line")),
                                      "startColumn": to_int(location.get("start_column")),
                                  },
                              }
                          }],
                      }
                      end_line = location.get("last_line")
                      end_column = location.get("last_column")
                      if end_line:
                          result["locations"][0]["physicalLocation"]["region"]["endLine"] = to_int(end_line)
                      if end_column:
                          result["locations"][0]["physicalLocation"]["region"]["endColumn"] = to_int(end_column)
                      sarif["runs"][0]["results"].append(result)

          with open("rubocop.sarif", "w", encoding="utf-8") as fh:
              json.dump(sarif, fh, indent=2)
          PY
          if ! jq -e '.version and (.runs | type == "array")' rubocop.sarif >/dev/null 2>&1; then
            echo '::warning::rubocop produced no valid SARIF; dropping the artifact'
            rm -f rubocop.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: rubocop
          path: rubocop.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  ruff:
    name: Ruff (Python lint)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Ruff security rules
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -name '*.py' -print | head -n 1 | grep -q .; then
            echo '::notice::no Python files found; skipping Ruff'
            exit 0
          fi
          uvx --from ruff ruff check --select S --output-format sarif -o ruff.sarif . || true
          if ! jq -e '.version and (.runs | type == "array")' ruff.sarif >/dev/null 2>&1; then
            echo '::warning::ruff produced no valid SARIF; dropping the artifact'
            rm -f ruff.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: ruff
          path: ruff.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  scancode:
    name: ScanCode Toolkit (license SBOM)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run ScanCode Toolkit
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          uvx --python 3.12 --from scancode-toolkit scancode --license --copyright --package --cyclonedx scancode.cdx.json . || true
          if ! jq -e '.bomFormat == "CycloneDX"' scancode.cdx.json >/dev/null 2>&1; then
            echo '::warning::scancode produced no valid CycloneDX JSON; dropping the artifact'
            rm -f scancode.cdx.json
          else
            # ScanCode writes explicit nulls for the fields it found nothing for — author,
            # description, version, copyright, externalReferences[].comment — and gives
            # some metadata properties array or object values. CycloneDX 1.3 types all of
            # those as strings, so the document fails schema validation on upload even
            # though the inventory in it is fine. A null key carries no information, so
            # dropping it loses nothing; a non-string property value becomes its JSON text.
            #
            # `version` is the exception to "a null key carries no information": CycloneDX
            # 1.3 lists it as REQUIRED on every component, so dropping a null one turns a
            # type error into "at '/components/0': missing property 'version'" and still
            # fails the upload. ScanCode legitimately has no version for a bare licence or
            # copyright match, so backfill the empty string, which is a valid value, rather
            # than inventing one.
            jq 'walk(if type == "object" then with_entries(select(.value != null)) else . end)
                | walk(if type == "object" and (.properties? | type) == "array"
                       then .properties |= map(if has("value") then .value |= (if type == "string" then . else tojson end) else . end)
                       else . end)
                | walk(if type == "object" and (.components? | type) == "array"
                       then .components |= map(.version //= "")
                       else . end)
                | if (.metadata?.component? | type) == "object" then .metadata.component.version //= "" else . end' \
                scancode.cdx.json > scancode.clean.json \
              && mv scancode.clean.json scancode.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: scancode
          path: scancode.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  semgrep:
    name: Semgrep (SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Semgrep
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          uvx --from semgrep semgrep scan --config auto --sarif --output semgrep.sarif .
      - uses: actions/upload-artifact@v6
        with:
          name: semgrep
          path: semgrep.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  shellcheck:
    name: ShellCheck (shell lint)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run ShellCheck
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          # The converter below runs under uv rather than whatever `python3` happens to
          # be on the runner. uv carries its own interpreter, so the script runs the same
          # way on every image, cannot be broken by a system Python that is missing or
          # externally managed, and cannot install anything into one.
          if ! command -v uv >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uv >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; cannot convert the report'
            exit 0
          fi
          set -uo pipefail
          scripts=$(find . -path ./.git -prune -o -type f \( -name '*.sh' -o -name '*.bash' \) -print)
          if [ -z "$scripts" ]; then
            echo '::notice::no shell scripts found; skipping ShellCheck'
            exit 0
          fi
          if ! command -v shellcheck >/dev/null 2>&1; then
            version=0.11.0
            mkdir -p /tmp/sc
            curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/v${version}/shellcheck-v${version}.linux.x86_64.tar.xz" \
              | tar -xJ -C /tmp/sc 2>/dev/null || true
            export PATH="/tmp/sc/shellcheck-v${version}:$PATH"
          fi
          if ! command -v shellcheck >/dev/null 2>&1; then
            echo '::warning::shellcheck could not be installed on this runner; skipping'
            exit 0
          fi
          # shellcheck exits 1 when it reports anything, which is a successful run.
          # shellcheck disable=SC2086
          shellcheck -f json1 $scripts >shellcheck.json 2>shellcheck.stderr || true
          uv run --no-project --python 3.12 python - <<'PY'
          import json
          import os

          sarif = {
              "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
              "version": "2.1.0",
              "runs": [{
                  "tool": {
                      "driver": {
                          "name": "ShellCheck",
                          "informationUri": "https://www.shellcheck.net/",
                          "rules": [],
                      }
                  },
                  "results": [],
              }],
          }
          rules_seen = set()
          level_map = {"error": "error", "warning": "warning", "info": "note", "style": "note"}


          def to_int(value):
              try:
                  return max(1, int(value))
              except (TypeError, ValueError):
                  return 1


          def add_rule(rule_id, comment):
              if rule_id in rules_seen:
                  return
              sarif["runs"][0]["tool"]["driver"]["rules"].append({
                  "id": rule_id,
                  "shortDescription": {"text": comment[:200]},
                  "helpUri": f"https://www.shellcheck.net/wiki/{rule_id}",
                  "defaultConfiguration": {"level": "warning"},
              })
              rules_seen.add(rule_id)


          if os.path.exists("shellcheck.json") and os.path.getsize("shellcheck.json") > 0:
              with open("shellcheck.json", "r", encoding="utf-8") as fh:
                  try:
                      data = json.load(fh)
                  except json.JSONDecodeError:
                      data = {}
              for item in data.get("comments") or []:
                  rule_id = "SC%s" % item.get("code")
                  message = str(item.get("message") or rule_id)
                  add_rule(rule_id, message)
                  sarif["runs"][0]["results"].append({
                      "ruleId": rule_id,
                      "level": level_map.get(str(item.get("level") or "").lower(), "warning"),
                      "message": {"text": message},
                      "locations": [{
                          "physicalLocation": {
                              "artifactLocation": {"uri": str(item.get("file") or "unknown")},
                              "region": {
                                  "startLine": to_int(item.get("line")),
                                  "startColumn": to_int(item.get("column")),
                              },
                          }
                      }],
                  })

          with open("shellcheck.sarif", "w", encoding="utf-8") as fh:
              json.dump(sarif, fh, indent=2)
          PY
          if ! jq -e '.version and (.runs | type == "array")' shellcheck.sarif >/dev/null 2>&1; then
            echo '::warning::shellcheck produced no valid SARIF; dropping the artifact'
            rm -f shellcheck.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: shellcheck
          path: shellcheck.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  swiftlint:
    name: SwiftLint (Swift lint)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run SwiftLint
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! find . -path ./.git -prune -o -type f -name '*.swift' -print | head -n 1 | grep -q .; then
            echo '::notice::no Swift files found; skipping SwiftLint'
            exit 0
          fi
          version=$(curl -fsSL https://api.github.com/repos/realm/SwiftLint/releases/latest | jq -r '.tag_name | ltrimstr("v")')
          if [ -z "$version" ] || [ "$version" = "null" ]; then
            echo '::warning::could not resolve latest SwiftLint container version; skipping SwiftLint'
            exit 0
          fi
          docker run --rm -v "$PWD:/work" -w /work "ghcr.io/realm/swiftlint:${version}" lint --reporter sarif >swiftlint.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' swiftlint.sarif >/dev/null 2>&1; then
            echo '::warning::swiftlint produced no valid SARIF; dropping the artifact'
            rm -f swiftlint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: swiftlint
          path: swiftlint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  syft:
    name: Syft (CycloneDX SBOM)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Generate CycloneDX SBOM
        continue-on-error: true
        uses: anchore/sbom-action@v0.24.0
        with:
          artifact-name: sbom.cdx.json
          format: cyclonedx-json
          output-file: sbom.cdx.json
          path: .
      - uses: actions/upload-artifact@v6
        with:
          name: syft
          path: sbom.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  syft-image:
    name: Syft image (CycloneDX SBOM)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Build the image
        id: build
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Dockerfile ] && [ ! -f Containerfile ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping'
            exit 0
          fi
          dockerfile=Dockerfile
          if [ -f Containerfile ]; then
            dockerfile=Containerfile
          fi
          image="vulnetix-scan:${GITHUB_SHA:-local}"
          if ! docker build -f "$dockerfile" -t "$image" . ; then
            echo '::warning::image build failed; nothing to scan'
            exit 0
          fi
          echo "image=$image" >> "$GITHUB_OUTPUT"
      - name: Generate image SBOM
        continue-on-error: true
        uses: anchore/sbom-action@v0.24.0
        with:
          format: cyclonedx-json
          image: '${{ steps.build.outputs.image }}'
          output-file: syft-image.cdx.json
          upload-artifact: false
      - name: Validate SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! jq -e '.bomFormat == "CycloneDX"' syft-image.cdx.json >/dev/null 2>&1; then
            echo '::warning::syft image produced no valid CycloneDX JSON; dropping the artifact'
            rm -f syft-image.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: syft-image
          path: syft-image.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  terrascan:
    name: Terrascan (Terraform)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run Terrascan
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          # terrascan writes SARIF to stdout and logs to stderr, so the redirect must
          # separate them. Exit 3 means violations were found and 5 means no IaC was
          # present; neither is a failure of the scan itself.
          docker run --rm -v "$PWD:/iac" tenable/terrascan:1.19.9 \
            scan -i terraform -d /iac -o sarif >terrascan.sarif 2>terrascan.stderr
          rc=$?
          case "$rc" in
            0|3) ;;
            5)   echo "::notice::terrascan found no IaC files" ;;
            *)   echo "::warning::terrascan exited $rc"; sed -n '1,20p' terrascan.stderr ;;
          esac
          # Without this guard a failed run leaves a zero-byte or half-written file that
          # `if-no-files-found` cannot detect, and it gets published as a "SARIF report".
          if ! jq -e '.version and (.runs | type == "array")' terrascan.sarif >/dev/null 2>&1; then
            echo "::warning::terrascan produced no valid SARIF; dropping the artifact"
            rm -f terrascan.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: terrascan
          path: terrascan.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  tflint:
    name: TFLint (Terraform)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run TFLint
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if ! find . -path ./.git -prune -o -type f -name '*.tf' -print | head -n 1 | grep -q .; then
            echo '::notice::no Terraform files found; skipping TFLint'
            exit 0
          fi
          curl -fsSL https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash >/dev/null 2>&1 || true
          export PATH="$HOME/.local/bin:/usr/local/bin:$PATH"
          if ! command -v tflint >/dev/null 2>&1; then
            echo '::warning::tflint could not be installed on this runner; skipping'
            exit 0
          fi
          tflint --init >/dev/null 2>&1 || true
          # tflint exits 2 when it reports issues.
          tflint --recursive --format sarif >tflint.sarif 2>tflint.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' tflint.sarif >/dev/null 2>&1; then
            echo '::warning::tflint produced no valid SARIF; dropping the artifact'
            rm -f tflint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: tflint
          path: tflint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  tfsec:
    name: tfsec (Terraform)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run tfsec
        continue-on-error: true
        uses: aquasecurity/tfsec-sarif-action@v0.1.4
        with:
          sarif_file: tfsec.sarif
      - uses: actions/upload-artifact@v6
        with:
          name: tfsec
          path: tfsec.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  trivy-config:
    name: Trivy config (IaC/Dockerfile)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Trivy config
        continue-on-error: true
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          format: sarif
          output: trivy-config.sarif
          scan-ref: .
          scan-type: config
      - uses: actions/upload-artifact@v6
        with:
          name: trivy-config
          path: trivy-config.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  trivy-fs:
    name: Trivy (filesystem CDX + SARIF)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Trivy filesystem (CycloneDX)
        continue-on-error: true
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          format: cyclonedx
          output: trivy-fs.cdx.json
          scan-ref: .
          scan-type: fs
      - name: Trivy filesystem (SARIF)
        continue-on-error: true
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          format: sarif
          output: trivy-fs.sarif
          scan-ref: .
          scan-type: fs
      - uses: actions/upload-artifact@v6
        with:
          name: trivy-fs
          path: |
            trivy-fs.cdx.json
            trivy-fs.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  trivy-image:
    name: Trivy image (OCI)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Build the image
        id: build
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Dockerfile ] && [ ! -f Containerfile ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping'
            exit 0
          fi
          dockerfile=Dockerfile
          if [ -f Containerfile ]; then
            dockerfile=Containerfile
          fi
          image="vulnetix-scan:${GITHUB_SHA:-local}"
          if ! docker build -f "$dockerfile" -t "$image" . ; then
            echo '::warning::image build failed; nothing to scan'
            exit 0
          fi
          echo "image=$image" >> "$GITHUB_OUTPUT"
      - name: Trivy image
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          image="${{ steps.build.outputs.image }}"
          if [ -z "$image" ]; then
            echo '::notice::no image was built; skipping Trivy image scan'
            exit 0
          fi
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD:/work" -w /work \
            aquasec/trivy:0.68.0 image --format sarif --output trivy-image.sarif --scanners vuln "$image" \
            >/dev/null 2>trivy-image.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' trivy-image.sarif >/dev/null 2>&1; then
            echo '::warning::trivy image produced no valid SARIF; dropping the artifact'
            rm -f trivy-image.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: trivy-image
          path: trivy-image.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  trufflehog:
    name: TruffleHog (secrets)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Run TruffleHog
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          # The converter below runs under uv rather than whatever `python3` happens to
          # be on the runner. uv carries its own interpreter, so the script runs the same
          # way on every image, cannot be broken by a system Python that is missing or
          # externally managed, and cannot install anything into one.
          if ! command -v uv >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uv >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; cannot convert the report'
            exit 0
          fi
          mkdir -p "$HOME/.local/bin"
          # Installed into a directory the job already owns rather than /usr/local/bin.
          # The runner pools do not grant general sudo, so the privileged install died on
          # a password prompt; a single binary does not need root anyway.
          curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b "$HOME/.local/bin" >/dev/null 2>&1 || true
          export PATH="$HOME/.local/bin:$PATH"
          if ! command -v trufflehog >/dev/null 2>&1; then
            echo '::warning::trufflehog could not be installed on this runner; skipping'
            exit 0
          fi
          trufflehog filesystem --json . >trufflehog.jsonl || true
          uv run --no-project --python 3.12 python - <<'PY'
          import json
          import os

          sarif = {
              "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
              "version": "2.1.0",
              "runs": [{
                  "tool": {
                      "driver": {
                          "name": "TruffleHog",
                          "informationUri": "https://github.com/trufflesecurity/trufflehog",
                          "rules": [],
                      }
                  },
                  "results": [],
              }],
          }
          rules_seen = set()

          def to_int(value):
              try:
                  return max(1, int(value))
              except (TypeError, ValueError):
                  return 1

          def add_rule(rule_id, detector):
              if rule_id in rules_seen:
                  return
              sarif["runs"][0]["tool"]["driver"]["rules"].append({
                  "id": rule_id,
                  "shortDescription": {"text": f"TruffleHog detector: {detector}"},
                  "defaultConfiguration": {"level": "error"},
              })
              rules_seen.add(rule_id)

          def source_location(item):
              metadata = item.get("SourceMetadata") or {}
              data = metadata.get("Data") or {}
              if isinstance(data, dict):
                  for value in data.values():
                      if not isinstance(value, dict):
                          continue
                      path = value.get("file") or value.get("File") or value.get("path") or value.get("Path")
                      if path:
                          line = value.get("line") or value.get("Line") or value.get("line_number") or value.get("LineNumber")
                          return str(path), to_int(line)
              return str(item.get("SourceName") or "unknown"), 1

          if os.path.exists("trufflehog.jsonl"):
              with open("trufflehog.jsonl", "r", encoding="utf-8", errors="replace") as fh:
                  for raw in fh:
                      raw = raw.strip()
                      if not raw:
                          continue
                      try:
                          item = json.loads(raw)
                      except json.JSONDecodeError:
                          continue
                      detector = str(item.get("DetectorName") or item.get("DetectorType") or "TruffleHog")
                      rule_id = detector.replace(" ", "-") or "TruffleHog"
                      add_rule(rule_id, detector)
                      path, line = source_location(item)
                      verified = bool(item.get("Verified"))
                      message = f"TruffleHog detected a {'verified ' if verified else ''}secret with detector {detector}."
                      redacted = item.get("Redacted")
                      if redacted:
                          message += f" Redacted value: {redacted}"
                      sarif["runs"][0]["results"].append({
                          "ruleId": rule_id,
                          "level": "error" if verified else "warning",
                          "message": {"text": message},
                          "locations": [{
                              "physicalLocation": {
                                  "artifactLocation": {"uri": path},
                                  "region": {"startLine": line},
                              }
                          }],
                      })

          with open("trufflehog.sarif", "w", encoding="utf-8") as fh:
              json.dump(sarif, fh, indent=2)
          PY
          if ! jq -e '.version and (.runs | type == "array")' trufflehog.sarif >/dev/null 2>&1; then
            echo '::warning::trufflehog produced no valid SARIF; dropping the artifact'
            rm -f trufflehog.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: trufflehog
          path: trufflehog.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  zizmor:
    name: zizmor (GitHub Actions SAST)
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run zizmor
        continue-on-error: true
        env:
          GH_TOKEN: '${{ github.token }}'
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          set -uo pipefail
          # zizmor exits 14 when it has findings, which is a successful scan.
          uvx --from zizmor zizmor --format sarif . >zizmor.sarif 2>zizmor.stderr
          rc=$?
          if [ "$rc" -ne 0 ] && [ "$rc" -ne 14 ]; then
            echo "::warning::zizmor exited $rc"; sed -n '1,20p' zizmor.stderr
          fi
          if ! jq -e '.version and (.runs | type == "array")' zizmor.sarif >/dev/null 2>&1; then
            echo "::warning::zizmor produced no valid SARIF; dropping the artifact"
            rm -f zizmor.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: zizmor
          path: zizmor.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

  publish:
    name: Publish to Vulnetix
    runs-on: [self-hosted, Linux, X64, vulnetix-local]
    timeout-minutes: 30
    needs: [bandit, bearer, brakeman, cdxgen, checkov, clippy, cppcheck, cyclonedx-go, cyclonedx-maven, cyclonedx-node, cyclonedx-php, cyclonedx-ruby, cyclonedx-rust, detect-secrets, detekt, dockle, eslint, flawfinder, github-sbom, gitleaks, golangci-lint, gosec, govulncheck, grype, grype-image, hadolint, kics, mobsfscan, njsscan, noseyparker, npm-audit, opengrep, osv-scanner, owasp-dependency-check, pmd, psalm, regula, retirejs, rubocop, ruff, scancode, semgrep, shellcheck, swiftlint, syft, syft-image, terrascan, tflint, tfsec, trivy-config, trivy-fs, trivy-image, trufflehog, zizmor]
    if: always()
    permissions:
      contents: read
      actions: read
    env:
      VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
      VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
    steps:
      - uses: actions/checkout@v5
      - name: Install Vulnetix CLI
        run: |
          curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - name: Publish scanner reports
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          if [ -z "${VULNETIX_ORG_ID:-}" ] || [ -z "${VULNETIX_API_KEY:-}" ]; then
            echo "::warning::VULNETIX_ORG_ID and VULNETIX_API_KEY are not set for this repository, so the scanners ran but nothing was published. Add both as repository secrets."
            exit 0
          fi
          vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json --no-banner --no-progress