Third-Party Scanners

vulnetix gha setup --list        # what is available
vulnetix gha setup gosec         # write the workflow
vulnetix gha setup trivy-fs      # add another; the first is kept

vulnetix gha setup conftest

  conftest:
    name: Conftest (Rego policy)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run Conftest
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if ! find . -path ./.git -prune -o -type f -name '*.rego' -print | head -n 1 | grep -q .; then
            echo '::notice::no Rego policies found; skipping Conftest'
            exit 0
          fi
          version=0.62.0
          mkdir -p /tmp/conftest
          curl -fsSL "https://github.com/open-policy-agent/conftest/releases/download/v${version}/conftest_${version}_Linux_x86_64.tar.gz" \
            | tar -xz -C /tmp/conftest 2>/dev/null || true
          if [ ! -x /tmp/conftest/conftest ]; then
            echo '::warning::conftest could not be installed on this runner; skipping'
            exit 0
          fi
          # `verify` runs the policies' own *_test.rego suites, which is the check that
          # means something in a repository whose product IS the policy set.
          /tmp/conftest/conftest verify -p . -o sarif >conftest.sarif 2>conftest.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' conftest.sarif >/dev/null 2>&1; then
            echo '::warning::conftest produced no valid SARIF; dropping the artifact'
            rm -f conftest.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: conftest
          path: conftest.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup owasp-zap

  owasp-zap:
    name: OWASP ZAP (DAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run ZAP baseline
        continue-on-error: true
        env:
          ZAP_TARGET_URL: '${{ vars.ZAP_TARGET_URL }}'
        shell: bash --noprofile --norc {0}
        run: |
          # The converter below runs under uv rather than whatever `python3` happens to
          # be on the runner. uv carries its own interpreter, so the script runs the same
          # way on every image, cannot be broken by a system Python that is missing or
          # externally managed, and cannot install anything into one.
          if ! command -v uv >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uv >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; cannot convert the report'
            exit 0
          fi
          set -uo pipefail
          if [ -z "${ZAP_TARGET_URL:-}" ]; then
            echo '::notice::ZAP_TARGET_URL is not set; skipping OWASP ZAP'
            exit 0
          fi
          # -I so a warning does not fail the container; findings are the point.
          docker run --rm -v "$PWD:/zap/wrk/:rw" ghcr.io/zaproxy/zaproxy:2.16.1 \
            zap-baseline.py -t "$ZAP_TARGET_URL" -J zap.json -I >/dev/null 2>zap.stderr || true
          uv run --no-project --python 3.12 python - <<'PY'
          import json
          import os

          sarif = {
              "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
              "version": "2.1.0",
              "runs": [{
                  "tool": {
                      "driver": {
                          "name": "OWASP ZAP",
                          "informationUri": "https://www.zaproxy.org/",
                          "rules": [],
                      }
                  },
                  "results": [],
              }],
          }
          rules_seen = set()
          # ZAP risk codes: 3 high, 2 medium, 1 low, 0 informational.
          level_map = {"3": "error", "2": "error", "1": "warning", "0": "note"}


          def add_rule(rule_id, name, desc):
              if rule_id in rules_seen:
                  return
              sarif["runs"][0]["tool"]["driver"]["rules"].append({
                  "id": rule_id,
                  "shortDescription": {"text": name[:200]},
                  "fullDescription": {"text": desc[:1000]},
                  "defaultConfiguration": {"level": "warning"},
              })
              rules_seen.add(rule_id)


          if os.path.exists("zap.json") and os.path.getsize("zap.json") > 0:
              with open("zap.json", "r", encoding="utf-8") as fh:
                  try:
                      data = json.load(fh)
                  except json.JSONDecodeError:
                      data = {}
              for site in data.get("site") or []:
                  for alert in site.get("alerts") or []:
                      rule_id = str(alert.get("pluginid") or alert.get("alertRef") or "zap")
                      name = str(alert.get("name") or rule_id)
                      add_rule(rule_id, name, str(alert.get("desc") or ""))
                      level = level_map.get(str(alert.get("riskcode") or "1"), "warning")
                      for instance in (alert.get("instances") or [{}]):
                          uri = str(instance.get("uri") or site.get("@name") or "unknown")
                          sarif["runs"][0]["results"].append({
                              "ruleId": rule_id,
                              "level": level,
                              "message": {"text": f"{name}: {instance.get('evidence') or alert.get('solution') or ''}".strip()},
                              "locations": [{
                                  "physicalLocation": {
                                      "artifactLocation": {"uri": uri},
                                      "region": {"startLine": 1},
                                  }
                              }],
                          })

          with open("owasp-zap.sarif", "w", encoding="utf-8") as fh:
              json.dump(sarif, fh, indent=2)
          PY
          if ! jq -e '.version and (.runs | type == "array")' owasp-zap.sarif >/dev/null 2>&1; then
            echo '::warning::owasp zap produced no valid SARIF; dropping the artifact'
            rm -f owasp-zap.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: owasp-zap
          path: owasp-zap.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup cfn-lint

  cfn-lint:
    name: cfn-lint (CloudFormation IaC)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run cfn-lint
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          templates=$(find . -path ./.git -prune -o -type f \( -name '*.template' -o -name '*.yaml' -o -name '*.yml' -o -name '*.json' \) -print)
          if [ -z "$templates" ]; then
            echo '::notice::no candidate CloudFormation templates found; skipping cfn-lint'
            exit 0
          fi
          uvx --from cfn-lint cfn-lint -f sarif -t $templates >cfn-lint.sarif 2>cfn-lint.stderr
          rc=$?
          if [ $rc -ne 0 ]; then
            echo "::warning::cfn-lint exited $rc"
            sed -n '1,20p' cfn-lint.stderr
          fi
          if ! jq -e '.version and (.runs | type == "array")' cfn-lint.sarif >/dev/null 2>&1; then
            echo '::warning::cfn-lint produced no valid SARIF; dropping the artifact'
            rm -f cfn-lint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cfn-lint
          path: cfn-lint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup checkov

  checkov:
    name: Checkov (IaC)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Checkov
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          uvx --from checkov checkov -d . -o sarif --output-file-path . --soft-fail || true
      - uses: actions/upload-artifact@v6
        with:
          name: checkov
          path: results.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup kics

  kics:
    name: KICS (IaC)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run KICS
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          mkdir -p kics-out
          docker run --rm -v "$PWD:/path" checkmarx/kics:v2.1.20 \
            scan -p /path -o /path/kics-out --report-formats sarif --no-progress || true
      - uses: actions/upload-artifact@v6
        with:
          name: kics
          path: kics-out/results.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup kube-linter

  kube-linter:
    name: KubeLinter (Kubernetes)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run KubeLinter
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          mkdir -p /tmp/kl
          curl -fsSL https://github.com/stackrox/kube-linter/releases/download/v0.7.6/kube-linter-linux.tar.gz \
            | tar -xz -C /tmp/kl 2>/dev/null || true
          if [ ! -x /tmp/kl/kube-linter ]; then
            echo '::warning::kube-linter could not be installed on this runner; skipping'
            exit 0
          fi
          # Exit 1 means findings.
          /tmp/kl/kube-linter lint --format sarif . >kube-linter.sarif 2>kube-linter.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' kube-linter.sarif >/dev/null 2>&1; then
            echo '::warning::kube-linter produced no valid SARIF; dropping the artifact'
            rm -f kube-linter.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: kube-linter
          path: kube-linter.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup kubescape

  kubescape:
    name: Kubescape (Kubernetes)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run Kubescape
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          curl -fsSL https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash >/dev/null 2>&1 || true
          export PATH="$HOME/.kubescape/bin:$HOME/.local/bin:/usr/local/bin:$PATH"
          if ! command -v kubescape >/dev/null 2>&1; then
            echo '::warning::kubescape could not be installed on this runner; skipping'
            exit 0
          fi
          kubescape scan . --format sarif --output kubescape.sarif >/dev/null 2>kubescape.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' kubescape.sarif >/dev/null 2>&1; then
            echo '::warning::kubescape produced no valid SARIF; dropping the artifact'
            rm -f kubescape.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: kubescape
          path: kubescape.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup regula

  regula:
    name: Regula (IaC policy)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run Regula
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          version=3.2.1
          mkdir -p /tmp/regula
          curl -fsSL "https://github.com/fugue/regula/releases/download/v${version}/regula_${version}_Linux_x86_64.tar.gz" \
            | tar -xz -C /tmp/regula 2>/dev/null || true
          if [ ! -x /tmp/regula/regula ]; then
            echo '::warning::regula could not be installed on this runner; skipping'
            exit 0
          fi
          # Exit 1 means policy violations.
          /tmp/regula/regula run --format sarif . >regula.sarif 2>regula.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' regula.sarif >/dev/null 2>&1; then
            echo '::warning::regula produced no valid SARIF; dropping the artifact'
            rm -f regula.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: regula
          path: regula.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup snyk-iac

  snyk-iac:
    name: Snyk IaC
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Run Snyk IaC
        continue-on-error: true
        env:
          SNYK_TOKEN: '${{ secrets.SNYK_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if [ -z "${SNYK_TOKEN:-}" ]; then
            echo '::notice::SNYK_TOKEN is not set; skipping Snyk IaC'
            exit 0
          fi
          npm install -g snyk >/dev/null 2>&1 || true
          snyk iac test --sarif-file-output=snyk-iac.sarif . 2>snyk-iac.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' snyk-iac.sarif >/dev/null 2>&1; then
            echo '::warning::snyk iac produced no valid SARIF; dropping the artifact'
            rm -f snyk-iac.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: snyk-iac
          path: snyk-iac.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup terrascan

  terrascan:
    name: Terrascan (Terraform)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run Terrascan
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          # terrascan writes SARIF to stdout and logs to stderr, so the redirect must
          # separate them. Exit 3 means violations were found and 5 means no IaC was
          # present; neither is a failure of the scan itself.
          docker run --rm -v "$PWD:/iac" tenable/terrascan:1.19.9 \
            scan -i terraform -d /iac -o sarif >terrascan.sarif 2>terrascan.stderr
          rc=$?
          case "$rc" in
            0|3) ;;
            5)   echo "::notice::terrascan found no IaC files" ;;
            *)   echo "::warning::terrascan exited $rc"; sed -n '1,20p' terrascan.stderr ;;
          esac
          # Without this guard a failed run leaves a zero-byte or half-written file that
          # `if-no-files-found` cannot detect, and it gets published as a "SARIF report".
          if ! jq -e '.version and (.runs | type == "array")' terrascan.sarif >/dev/null 2>&1; then
            echo "::warning::terrascan produced no valid SARIF; dropping the artifact"
            rm -f terrascan.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: terrascan
          path: terrascan.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup tflint

  tflint:
    name: TFLint (Terraform)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run TFLint
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if ! find . -path ./.git -prune -o -type f -name '*.tf' -print | head -n 1 | grep -q .; then
            echo '::notice::no Terraform files found; skipping TFLint'
            exit 0
          fi
          curl -fsSL https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash >/dev/null 2>&1 || true
          export PATH="$HOME/.local/bin:/usr/local/bin:$PATH"
          if ! command -v tflint >/dev/null 2>&1; then
            echo '::warning::tflint could not be installed on this runner; skipping'
            exit 0
          fi
          tflint --init >/dev/null 2>&1 || true
          # tflint exits 2 when it reports issues.
          tflint --recursive --format sarif >tflint.sarif 2>tflint.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' tflint.sarif >/dev/null 2>&1; then
            echo '::warning::tflint produced no valid SARIF; dropping the artifact'
            rm -f tflint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: tflint
          path: tflint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup tfsec

  tfsec:
    name: tfsec (Terraform)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run tfsec
        continue-on-error: true
        uses: aquasecurity/tfsec-sarif-action@v0.1.4
        with:
          sarif_file: tfsec.sarif
      - uses: actions/upload-artifact@v6
        with:
          name: tfsec
          path: tfsec.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup trivy-config

  trivy-config:
    name: Trivy config (IaC/Dockerfile)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Trivy config
        continue-on-error: true
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          format: sarif
          output: trivy-config.sarif
          scan-ref: .
          scan-type: config
      - uses: actions/upload-artifact@v6
        with:
          name: trivy-config
          path: trivy-config.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup scancode

  scancode:
    name: ScanCode Toolkit (license SBOM)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run ScanCode Toolkit
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          uvx --python 3.12 --from scancode-toolkit scancode --license --copyright --package --cyclonedx scancode.cdx.json . || true
          if ! jq -e '.bomFormat == "CycloneDX"' scancode.cdx.json >/dev/null 2>&1; then
            echo '::warning::scancode produced no valid CycloneDX JSON; dropping the artifact'
            rm -f scancode.cdx.json
          else
            # ScanCode writes explicit nulls for the fields it found nothing for — author,
            # description, version, copyright, externalReferences[].comment — and gives
            # some metadata properties array or object values. CycloneDX 1.3 types all of
            # those as strings, so the document fails schema validation on upload even
            # though the inventory in it is fine. A null key carries no information, so
            # dropping it loses nothing; a non-string property value becomes its JSON text.
            #
            # `version` is the exception to "a null key carries no information": CycloneDX
            # 1.3 lists it as REQUIRED on every component, so dropping a null one turns a
            # type error into "at '/components/0': missing property 'version'" and still
            # fails the upload. ScanCode legitimately has no version for a bare licence or
            # copyright match, so backfill the empty string, which is a valid value, rather
            # than inventing one.
            jq 'walk(if type == "object" then with_entries(select(.value != null)) else . end)
                | walk(if type == "object" and (.properties? | type) == "array"
                       then .properties |= map(if has("value") then .value |= (if type == "string" then . else tojson end) else . end)
                       else . end)
                | walk(if type == "object" and (.components? | type) == "array"
                       then .components |= map(.version //= "")
                       else . end)
                | if (.metadata?.component? | type) == "object" then .metadata.component.version //= "" else . end' \
                scancode.cdx.json > scancode.clean.json \
              && mv scancode.clean.json scancode.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: scancode
          path: scancode.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup clippy

  clippy:
    name: Rust Clippy (SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run Clippy
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          rustup component add clippy
          cargo install clippy-sarif sarif-fmt
          # cargo clippy exits non-zero when it emits warnings, which is a successful run.
          cargo clippy --all-targets --all-features --message-format=json \
            | clippy-sarif >clippy.sarif 2>clippy.stderr
          if ! jq -e '.version and (.runs | type == "array")' clippy.sarif >/dev/null 2>&1; then
            echo "::warning::clippy produced no valid SARIF; dropping the artifact"
            sed -n '1,20p' clippy.stderr
            rm -f clippy.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: clippy
          path: clippy.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup eslint

  eslint:
    name: ESLint (JavaScript lint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node.js
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Run ESLint
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f package.json ]; then
            echo '::notice::no package.json found; skipping ESLint'
            exit 0
          fi
          if ! ls eslint.config.* .eslintrc .eslintrc.* >/dev/null 2>&1; then
            echo '::notice::no ESLint config found; skipping ESLint'
            exit 0
          fi
          if [ -f package-lock.json ]; then
            npm ci
          else
            npm install --no-audit --no-fund
          fi
          npm install --no-audit --no-fund --no-save @microsoft/eslint-formatter-sarif
          npx eslint -f @microsoft/eslint-formatter-sarif -o eslint.sarif . || true
          if ! jq -e '.version and (.runs | type == "array")' eslint.sarif >/dev/null 2>&1; then
            echo '::warning::eslint produced no valid SARIF; dropping the artifact'
            rm -f eslint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: eslint
          path: eslint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup golangci-lint

  golangci-lint:
    name: golangci-lint (Go lint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run golangci-lint
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ ! -f go.mod ]; then
            echo '::notice::no go.mod found; skipping golangci-lint'
            exit 0
          fi
          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
          golangci-lint run --output.sarif.path=golangci-lint.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' golangci-lint.sarif >/dev/null 2>&1; then
            echo '::warning::golangci-lint produced no valid SARIF; dropping the artifact'
            rm -f golangci-lint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: golangci-lint
          path: golangci-lint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup rubocop

  rubocop:
    name: RuboCop (Ruby lint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Ruby
        continue-on-error: true
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ruby
      - name: Run RuboCop
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          # The converter below runs under uv rather than whatever `python3` happens to
          # be on the runner. uv carries its own interpreter, so the script runs the same
          # way on every image, cannot be broken by a system Python that is missing or
          # externally managed, and cannot install anything into one.
          if ! command -v uv >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uv >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; cannot convert the report'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -name '*.rb' -print | head -n 1 | grep -q .; then
            echo '::notice::no Ruby files found; skipping RuboCop'
            exit 0
          fi
          gem install rubocop
          rubocop --format github --out rubocop.github-actions.txt || true
          rubocop --format json --out rubocop.json || true
          uv run --no-project --python 3.12 python - <<'PY'
          import json
          import os

          sarif = {
              "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
              "version": "2.1.0",
              "runs": [{
                  "tool": {
                      "driver": {
                          "name": "RuboCop",
                          "informationUri": "https://github.com/rubocop/rubocop",
                          "rules": [],
                      }
                  },
                  "results": [],
              }],
          }
          rules_seen = set()
          severity_map = {
              "fatal": "error",
              "error": "error",
              "warning": "warning",
              "refactor": "warning",
              "convention": "note",
              "info": "note",
          }

          def to_int(value):
              try:
                  return max(1, int(value))
              except (TypeError, ValueError):
                  return 1

          def add_rule(rule_id):
              if rule_id in rules_seen:
                  return
              sarif["runs"][0]["tool"]["driver"]["rules"].append({
                  "id": rule_id,
                  "shortDescription": {"text": rule_id},
                  "defaultConfiguration": {"level": "warning"},
              })
              rules_seen.add(rule_id)

          if os.path.exists("rubocop.json") and os.path.getsize("rubocop.json") > 0:
              with open("rubocop.json", "r", encoding="utf-8") as fh:
                  data = json.load(fh)
              version = str((data.get("metadata") or {}).get("rubocop_version") or "")
              if version:
                  sarif["runs"][0]["tool"]["driver"]["version"] = version
              for file_info in data.get("files") or []:
                  path = str(file_info.get("path") or "unknown")
                  for offense in file_info.get("offenses") or []:
                      rule_id = str(offense.get("cop_name") or "RuboCop")
                      add_rule(rule_id)
                      location = offense.get("location") or {}
                      level = severity_map.get(str(offense.get("severity") or "").lower(), "warning")
                      result = {
                          "ruleId": rule_id,
                          "level": level,
                          "message": {"text": str(offense.get("message") or rule_id)},
                          "locations": [{
                              "physicalLocation": {
                                  "artifactLocation": {"uri": path},
                                  "region": {
                                      "startLine": to_int(location.get("start_line")),
                                      "startColumn": to_int(location.get("start_column")),
                                  },
                              }
                          }],
                      }
                      end_line = location.get("last_line")
                      end_column = location.get("last_column")
                      if end_line:
                          result["locations"][0]["physicalLocation"]["region"]["endLine"] = to_int(end_line)
                      if end_column:
                          result["locations"][0]["physicalLocation"]["region"]["endColumn"] = to_int(end_column)
                      sarif["runs"][0]["results"].append(result)

          with open("rubocop.sarif", "w", encoding="utf-8") as fh:
              json.dump(sarif, fh, indent=2)
          PY
          if ! jq -e '.version and (.runs | type == "array")' rubocop.sarif >/dev/null 2>&1; then
            echo '::warning::rubocop produced no valid SARIF; dropping the artifact'
            rm -f rubocop.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: rubocop
          path: rubocop.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup ruff

  ruff:
    name: Ruff (Python lint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Ruff security rules
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -name '*.py' -print | head -n 1 | grep -q .; then
            echo '::notice::no Python files found; skipping Ruff'
            exit 0
          fi
          uvx --from ruff ruff check --select S --output-format sarif -o ruff.sarif . || true
          if ! jq -e '.version and (.runs | type == "array")' ruff.sarif >/dev/null 2>&1; then
            echo '::warning::ruff produced no valid SARIF; dropping the artifact'
            rm -f ruff.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: ruff
          path: ruff.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup shellcheck

  shellcheck:
    name: ShellCheck (shell lint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run ShellCheck
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          # The converter below runs under uv rather than whatever `python3` happens to
          # be on the runner. uv carries its own interpreter, so the script runs the same
          # way on every image, cannot be broken by a system Python that is missing or
          # externally managed, and cannot install anything into one.
          if ! command -v uv >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uv >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; cannot convert the report'
            exit 0
          fi
          set -uo pipefail
          scripts=$(find . -path ./.git -prune -o -type f \( -name '*.sh' -o -name '*.bash' \) -print)
          if [ -z "$scripts" ]; then
            echo '::notice::no shell scripts found; skipping ShellCheck'
            exit 0
          fi
          if ! command -v shellcheck >/dev/null 2>&1; then
            version=0.11.0
            mkdir -p /tmp/sc
            curl -fsSL "https://github.com/koalaman/shellcheck/releases/download/v${version}/shellcheck-v${version}.linux.x86_64.tar.xz" \
              | tar -xJ -C /tmp/sc 2>/dev/null || true
            export PATH="/tmp/sc/shellcheck-v${version}:$PATH"
          fi
          if ! command -v shellcheck >/dev/null 2>&1; then
            echo '::warning::shellcheck could not be installed on this runner; skipping'
            exit 0
          fi
          # shellcheck exits 1 when it reports anything, which is a successful run.
          # shellcheck disable=SC2086
          shellcheck -f json1 $scripts >shellcheck.json 2>shellcheck.stderr || true
          uv run --no-project --python 3.12 python - <<'PY'
          import json
          import os

          sarif = {
              "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
              "version": "2.1.0",
              "runs": [{
                  "tool": {
                      "driver": {
                          "name": "ShellCheck",
                          "informationUri": "https://www.shellcheck.net/",
                          "rules": [],
                      }
                  },
                  "results": [],
              }],
          }
          rules_seen = set()
          level_map = {"error": "error", "warning": "warning", "info": "note", "style": "note"}


          def to_int(value):
              try:
                  return max(1, int(value))
              except (TypeError, ValueError):
                  return 1


          def add_rule(rule_id, comment):
              if rule_id in rules_seen:
                  return
              sarif["runs"][0]["tool"]["driver"]["rules"].append({
                  "id": rule_id,
                  "shortDescription": {"text": comment[:200]},
                  "helpUri": f"https://www.shellcheck.net/wiki/{rule_id}",
                  "defaultConfiguration": {"level": "warning"},
              })
              rules_seen.add(rule_id)


          if os.path.exists("shellcheck.json") and os.path.getsize("shellcheck.json") > 0:
              with open("shellcheck.json", "r", encoding="utf-8") as fh:
                  try:
                      data = json.load(fh)
                  except json.JSONDecodeError:
                      data = {}
              for item in data.get("comments") or []:
                  rule_id = "SC%s" % item.get("code")
                  message = str(item.get("message") or rule_id)
                  add_rule(rule_id, message)
                  sarif["runs"][0]["results"].append({
                      "ruleId": rule_id,
                      "level": level_map.get(str(item.get("level") or "").lower(), "warning"),
                      "message": {"text": message},
                      "locations": [{
                          "physicalLocation": {
                              "artifactLocation": {"uri": str(item.get("file") or "unknown")},
                              "region": {
                                  "startLine": to_int(item.get("line")),
                                  "startColumn": to_int(item.get("column")),
                              },
                          }
                      }],
                  })

          with open("shellcheck.sarif", "w", encoding="utf-8") as fh:
              json.dump(sarif, fh, indent=2)
          PY
          if ! jq -e '.version and (.runs | type == "array")' shellcheck.sarif >/dev/null 2>&1; then
            echo '::warning::shellcheck produced no valid SARIF; dropping the artifact'
            rm -f shellcheck.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: shellcheck
          path: shellcheck.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup stylelint

  stylelint:
    name: Stylelint (CSS lint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node.js
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Run Stylelint
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! find . -path ./.git -prune -o -type f -print | grep -E '\.(css|scss|less)$' | head -n 1 | grep -q .; then
            echo '::notice::no CSS files found; skipping Stylelint'
            exit 0
          fi
          if ! ls .stylelintrc* stylelint.config.* >/dev/null 2>&1; then
            echo '::notice::no Stylelint config found; skipping Stylelint'
            exit 0
          fi
          npm install --no-audit --no-fund --no-save stylelint stylelint-sarif-formatter
          npx stylelint '**/*.{css,scss,less}' --custom-formatter=node_modules/stylelint-sarif-formatter -o stylelint.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' stylelint.sarif >/dev/null 2>&1; then
            echo '::warning::stylelint produced no valid SARIF; dropping the artifact'
            rm -f stylelint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: stylelint
          path: stylelint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup swiftlint

  swiftlint:
    name: SwiftLint (Swift lint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run SwiftLint
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! find . -path ./.git -prune -o -type f -name '*.swift' -print | head -n 1 | grep -q .; then
            echo '::notice::no Swift files found; skipping SwiftLint'
            exit 0
          fi
          version=$(curl -fsSL https://api.github.com/repos/realm/SwiftLint/releases/latest | jq -r '.tag_name | ltrimstr("v")')
          if [ -z "$version" ] || [ "$version" = "null" ]; then
            echo '::warning::could not resolve latest SwiftLint container version; skipping SwiftLint'
            exit 0
          fi
          docker run --rm -v "$PWD:/work" -w /work "ghcr.io/realm/swiftlint:${version}" lint --reporter sarif >swiftlint.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' swiftlint.sarif >/dev/null 2>&1; then
            echo '::warning::swiftlint produced no valid SARIF; dropping the artifact'
            rm -f swiftlint.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: swiftlint
          path: swiftlint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup mobsfscan

  mobsfscan:
    name: mobsfscan (Mobile SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run mobsfscan
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          set -uo pipefail
          # mobsfscan exits 1 when it reports findings.
          uvx --from mobsfscan mobsfscan --sarif -o mobsfscan.sarif . 2>mobsfscan.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' mobsfscan.sarif >/dev/null 2>&1; then
            echo '::warning::mobsfscan produced no valid SARIF; dropping the artifact'
            rm -f mobsfscan.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: mobsfscan
          path: mobsfscan.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup dockle

  dockle:
    name: Dockle (container image)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run Dockle
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ ! -f Dockerfile ] && [ ! -f Containerfile ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping Dockle'
            exit 0
          fi
          dockerfile=Dockerfile
          if [ -f Containerfile ]; then
            dockerfile=Containerfile
          fi
          image="vulnetix-dockle:${GITHUB_SHA:-local}"
          docker build -f "$dockerfile" -t "$image" .
          go install github.com/goodwithtech/dockle/cmd/dockle@latest
          dockle --format sarif --output dockle.sarif "$image" || true
          if ! jq -e '.version and (.runs | type == "array")' dockle.sarif >/dev/null 2>&1; then
            echo '::warning::dockle produced no valid SARIF; dropping the artifact'
            rm -f dockle.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: dockle
          path: dockle.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup grype-image

  grype-image:
    name: Grype image (OCI)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Build the image
        id: build
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Dockerfile ] && [ ! -f Containerfile ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping'
            exit 0
          fi
          dockerfile=Dockerfile
          if [ -f Containerfile ]; then
            dockerfile=Containerfile
          fi
          image="vulnetix-scan:${GITHUB_SHA:-local}"
          if ! docker build -f "$dockerfile" -t "$image" . ; then
            echo '::warning::image build failed; nothing to scan'
            exit 0
          fi
          echo "image=$image" >> "$GITHUB_OUTPUT"
      - name: Run Grype
        id: grype
        continue-on-error: true
        uses: anchore/scan-action@v7
        with:
          fail-build: false
          image: '${{ steps.build.outputs.image }}'
          output-format: sarif
      - name: Stage Grype SARIF
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${{ steps.grype.outputs.sarif }}" ]; then
            cp "${{ steps.grype.outputs.sarif }}" grype-image.sarif || true
          fi
          if ! jq -e '.version and (.runs | type == "array")' grype-image.sarif >/dev/null 2>&1; then
            echo '::warning::grype image produced no valid SARIF; dropping the artifact'
            rm -f grype-image.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: grype-image
          path: grype-image.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup hadolint

  hadolint:
    name: Hadolint (Dockerfile)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run Hadolint
        continue-on-error: true
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile
          format: sarif
          no-fail: true
          output-file: hadolint.sarif
      - uses: actions/upload-artifact@v6
        with:
          name: hadolint
          path: hadolint.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup snyk-container

  snyk-container:
    name: Snyk Container (OCI)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Build the image
        id: build
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Dockerfile ] && [ ! -f Containerfile ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping'
            exit 0
          fi
          dockerfile=Dockerfile
          if [ -f Containerfile ]; then
            dockerfile=Containerfile
          fi
          image="vulnetix-scan:${GITHUB_SHA:-local}"
          if ! docker build -f "$dockerfile" -t "$image" . ; then
            echo '::warning::image build failed; nothing to scan'
            exit 0
          fi
          echo "image=$image" >> "$GITHUB_OUTPUT"
      - name: Run Snyk Container
        continue-on-error: true
        env:
          SNYK_TOKEN: '${{ secrets.SNYK_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if [ -z "${SNYK_TOKEN:-}" ]; then
            echo '::notice::SNYK_TOKEN is not set; skipping Snyk Container'
            exit 0
          fi
          image="${{ steps.build.outputs.image }}"
          if [ -z "$image" ]; then
            echo '::notice::no image was built; skipping Snyk Container'
            exit 0
          fi
          npm install -g snyk >/dev/null 2>&1 || true
          snyk container test "$image" --sarif-file-output=snyk-container.sarif 2>snyk-container.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' snyk-container.sarif >/dev/null 2>&1; then
            echo '::warning::snyk container produced no valid SARIF; dropping the artifact'
            rm -f snyk-container.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: snyk-container
          path: snyk-container.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup syft-image

  syft-image:
    name: Syft image (CycloneDX SBOM)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Build the image
        id: build
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Dockerfile ] && [ ! -f Containerfile ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping'
            exit 0
          fi
          dockerfile=Dockerfile
          if [ -f Containerfile ]; then
            dockerfile=Containerfile
          fi
          image="vulnetix-scan:${GITHUB_SHA:-local}"
          if ! docker build -f "$dockerfile" -t "$image" . ; then
            echo '::warning::image build failed; nothing to scan'
            exit 0
          fi
          echo "image=$image" >> "$GITHUB_OUTPUT"
      - name: Generate image SBOM
        continue-on-error: true
        uses: anchore/sbom-action@v0.24.0
        with:
          format: cyclonedx-json
          image: '${{ steps.build.outputs.image }}'
          output-file: syft-image.cdx.json
          upload-artifact: false
      - name: Validate SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! jq -e '.bomFormat == "CycloneDX"' syft-image.cdx.json >/dev/null 2>&1; then
            echo '::warning::syft image produced no valid CycloneDX JSON; dropping the artifact'
            rm -f syft-image.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: syft-image
          path: syft-image.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup trivy-image

  trivy-image:
    name: Trivy image (OCI)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Build the image
        id: build
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Dockerfile ] && [ ! -f Containerfile ]; then
            echo '::notice::no Dockerfile or Containerfile found; skipping'
            exit 0
          fi
          dockerfile=Dockerfile
          if [ -f Containerfile ]; then
            dockerfile=Containerfile
          fi
          image="vulnetix-scan:${GITHUB_SHA:-local}"
          if ! docker build -f "$dockerfile" -t "$image" . ; then
            echo '::warning::image build failed; nothing to scan'
            exit 0
          fi
          echo "image=$image" >> "$GITHUB_OUTPUT"
      - name: Trivy image
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          image="${{ steps.build.outputs.image }}"
          if [ -z "$image" ]; then
            echo '::notice::no image was built; skipping Trivy image scan'
            exit 0
          fi
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD:/work" -w /work \
            aquasec/trivy:0.68.0 image --format sarif --output trivy-image.sarif --scanners vuln "$image" \
            >/dev/null 2>trivy-image.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' trivy-image.sarif >/dev/null 2>&1; then
            echo '::warning::trivy image produced no valid SARIF; dropping the artifact'
            rm -f trivy-image.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: trivy-image
          path: trivy-image.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup nuclei

  nuclei:
    name: Nuclei (DAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run Nuclei
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
          NUCLEI_TARGET_URL: '${{ vars.NUCLEI_TARGET_URL }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ -z "${NUCLEI_TARGET_URL:-}" ]; then
            echo '::notice::NUCLEI_TARGET_URL is not set; skipping Nuclei'
            exit 0
          fi
          go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
          nuclei -u "$NUCLEI_TARGET_URL" -severity critical,high -se nuclei.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' nuclei.sarif >/dev/null 2>&1; then
            echo '::warning::nuclei produced no valid SARIF; dropping the artifact'
            rm -f nuclei.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: nuclei
          path: nuclei.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup bandit

  bandit:
    name: Bandit (Python SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Bandit
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -name '*.py' -print | head -n 1 | grep -q .; then
            echo '::notice::no Python files found; skipping Bandit'
            exit 0
          fi
          uvx --from 'bandit[sarif]' bandit -r . -f sarif -o bandit.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' bandit.sarif >/dev/null 2>&1; then
            echo '::warning::bandit produced no valid SARIF; dropping the artifact'
            rm -f bandit.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: bandit
          path: bandit.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup bearer

  bearer:
    name: Bearer (SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run Bearer
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b "$HOME/.local/bin" >/dev/null 2>&1 || true
          export PATH="$HOME/.local/bin:$PATH"
          if ! command -v bearer >/dev/null 2>&1; then
            echo '::warning::bearer could not be installed on this runner; skipping'
            exit 0
          fi
          # --exit-code 0 because a finding is a successful scan, not a broken one.
          bearer scan . --format sarif --output bearer.sarif --exit-code 0 --quiet 2>bearer.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' bearer.sarif >/dev/null 2>&1; then
            echo '::warning::bearer produced no valid SARIF; dropping the artifact'
            rm -f bearer.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: bearer
          path: bearer.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup brakeman

  brakeman:
    name: Brakeman (Ruby on Rails SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Ruby
        continue-on-error: true
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: ruby
      - name: Run Brakeman
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f Gemfile ] || ! grep -E 'rails|railties' Gemfile Gemfile.lock >/dev/null 2>&1; then
            echo '::notice::no Rails app detected; skipping Brakeman'
            exit 0
          fi
          gem install brakeman
          brakeman -f sarif -o brakeman.sarif || true
          if ! jq -e '.version and (.runs | type == "array")' brakeman.sarif >/dev/null 2>&1; then
            echo '::warning::brakeman produced no valid SARIF; dropping the artifact'
            rm -f brakeman.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: brakeman
          path: brakeman.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup cppcheck

  cppcheck:
    name: Cppcheck (C/C++ SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run Cppcheck
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! find . -path ./.git -prune -o -type f -print | grep -E '\.(c|cc|cpp|h|hpp)$' | head -n 1 | grep -q .; then
            echo '::notice::no C/C++ files found; skipping Cppcheck'
            exit 0
          fi
          # Resolve how to become root, or do without it.
          #
          # The AWS runner pools grant exactly one sudo rule — writing the busy/idle
          # heartbeat — because general NOPASSWD sudo would hand the instance role to
          # every workflow on the box through IMDS. A blind `sudo` there does not fail
          # with "permission denied": it blocks on a password prompt and dies with
          # "sudo: a terminal is required to read the password".
          SUDO=""
          if [ "$(id -u)" -ne 0 ]; then
            if sudo -n true 2>/dev/null; then
              SUDO="sudo -n"
            fi
          fi
          if [ -n "$SUDO" ] || [ "$(id -u)" -eq 0 ]; then
            if command -v apt-get >/dev/null 2>&1; then
              $SUDO apt-get update -qq && $SUDO apt-get install -y -qq cppcheck || true
            elif command -v dnf >/dev/null 2>&1; then
              $SUDO dnf install -y -q cppcheck || true
            elif command -v apk >/dev/null 2>&1; then
              $SUDO apk add --no-cache cppcheck || true
            fi
          fi
          if ! command -v cppcheck >/dev/null 2>&1; then
            echo '::warning::cppcheck could not be installed on this runner; skipping'
            exit 0
          fi
          cppcheck --enable=warning,style,performance,portability --output-format=sarif --output-file=cppcheck.sarif . || true
          if ! jq -e '.version and (.runs | type == "array")' cppcheck.sarif >/dev/null 2>&1; then
            echo '::warning::cppcheck produced no valid SARIF; dropping the artifact'
            rm -f cppcheck.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cppcheck
          path: cppcheck.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup detekt

  detekt:
    name: detekt (Kotlin SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Java
        continue-on-error: true
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
      - name: Run detekt
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if ! find . -path ./.git -prune -o -type f -name '*.kt' -print | head -n 1 | grep -q .; then
            echo '::notice::no Kotlin files found; skipping detekt'
            exit 0
          fi
          version=1.23.8
          curl -fsSL -o detekt-cli.zip "https://github.com/detekt/detekt/releases/download/v${version}/detekt-cli-${version}.zip" || true
          if [ ! -s detekt-cli.zip ]; then
            echo '::warning::could not download detekt; skipping'
            exit 0
          fi
          unzip -q -o detekt-cli.zip
          # detekt exits 2 when it reports issues, which is a successful run.
          "detekt-cli-${version}/bin/detekt-cli" --input . --report sarif:detekt.sarif 2>detekt.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' detekt.sarif >/dev/null 2>&1; then
            echo '::warning::detekt produced no valid SARIF; dropping the artifact'
            rm -f detekt.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: detekt
          path: detekt.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup flawfinder

  flawfinder:
    name: Flawfinder (C/C++ SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Flawfinder
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -print | grep -E '\.(c|cc|cpp|h|hpp)$' | head -n 1 | grep -q .; then
            echo '::notice::no C/C++ files found; skipping Flawfinder'
            exit 0
          fi
          uvx --from flawfinder flawfinder --sarif . >flawfinder.sarif 2>flawfinder.stderr
          rc=$?
          if [ $rc -ne 0 ] && [ $rc -ne 1 ]; then
            echo "::warning::flawfinder exited $rc"
            sed -n '1,20p' flawfinder.stderr
          fi
          if ! jq -e '.version and (.runs | type == "array")' flawfinder.sarif >/dev/null 2>&1; then
            echo '::warning::flawfinder produced no valid SARIF; dropping the artifact'
            rm -f flawfinder.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: flawfinder
          path: flawfinder.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup gosec

  gosec:
    name: gosec (Go SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Run gosec
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ ! -f go.mod ]; then
            echo '::notice::no go.mod found; skipping gosec'
            exit 0
          fi
          go install github.com/securego/gosec/v2/cmd/gosec@v2.28.0
          gosec -no-fail -fmt sarif -out gosec.sarif ./... || true
          if ! jq -e '.version and (.runs | type == "array")' gosec.sarif >/dev/null 2>&1; then
            echo '::warning::gosec produced no valid SARIF; dropping the artifact'
            rm -f gosec.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: gosec
          path: gosec.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup njsscan

  njsscan:
    name: njsscan (Node SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run njsscan
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          if ! find . -path ./.git -prune -o -type f -print | grep -E '\.(js|jsx|ts|tsx)$' | head -n 1 | grep -q .; then
            echo '::notice::no JavaScript or TypeScript files found; skipping njsscan'
            exit 0
          fi
          uvx --from njsscan njsscan --sarif -o njsscan.sarif . || true
          if ! jq -e '.version and (.runs | type == "array")' njsscan.sarif >/dev/null 2>&1; then
            echo '::warning::njsscan produced no valid SARIF; dropping the artifact'
            rm -f njsscan.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: njsscan
          path: njsscan.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup opengrep

  opengrep:
    name: OpenGrep (SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run OpenGrep
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash >/dev/null 2>&1 || true
          export PATH="$HOME/.opengrep/cli/latest:$HOME/.local/bin:$PATH"
          if ! command -v opengrep >/dev/null 2>&1; then
            echo '::warning::opengrep could not be installed on this runner; skipping'
            exit 0
          fi
          # The CLI tracks Semgrep's flags, but the SARIF flag was renamed between
          # releases. Try the current spelling, then the older one.
          opengrep scan --config auto --sarif --output opengrep.sarif . >/dev/null 2>opengrep.stderr \
            || opengrep scan --config auto --sarif-output=opengrep.sarif . >/dev/null 2>>opengrep.stderr \
            || true
          if ! jq -e '.version and (.runs | type == "array")' opengrep.sarif >/dev/null 2>&1; then
            echo '::warning::opengrep produced no valid SARIF; dropping the artifact'
            rm -f opengrep.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: opengrep
          path: opengrep.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup pmd

  pmd:
    name: PMD (Java SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Run PMD
        continue-on-error: true
        uses: pmd/pmd-github-action@v2
        with:
          analyzeModifiedFilesOnly: false
          rulesets: rulesets/java/quickstart.xml
          version: latest
      - uses: actions/upload-artifact@v6
        with:
          name: pmd
          path: pmd-report.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup psalm

  psalm:
    name: Psalm (PHP SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up PHP
        continue-on-error: true
        uses: shivammathur/setup-php@v2
        with:
          coverage: none
          php-version: 8.3
      - name: Run Psalm
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if [ ! -f composer.json ]; then
            echo '::notice::no composer.json found; skipping Psalm'
            exit 0
          fi
          composer require --dev --no-interaction --quiet vimeo/psalm || true
          if [ ! -x vendor/bin/psalm ]; then
            echo '::warning::psalm could not be installed; skipping'
            exit 0
          fi
          if [ ! -f psalm.xml ] && [ ! -f psalm.xml.dist ]; then
            vendor/bin/psalm --init . 1 >/dev/null 2>&1 || true
          fi
          # Psalm exits non-zero when it reports issues.
          vendor/bin/psalm --no-cache --no-progress --report=psalm.sarif 2>psalm.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' psalm.sarif >/dev/null 2>&1; then
            echo '::warning::psalm produced no valid SARIF; dropping the artifact'
            rm -f psalm.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: psalm
          path: psalm.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup semgrep

  semgrep:
    name: Semgrep (SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run Semgrep
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          uvx --from semgrep semgrep scan --config auto --sarif --output semgrep.sarif .
      - uses: actions/upload-artifact@v6
        with:
          name: semgrep
          path: semgrep.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup snyk-code

  snyk-code:
    name: Snyk Code (SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 22
      - name: Run Snyk Code
        continue-on-error: true
        env:
          SNYK_TOKEN: '${{ secrets.SNYK_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if [ -z "${SNYK_TOKEN:-}" ]; then
            echo '::notice::SNYK_TOKEN is not set; skipping Snyk Code'
            exit 0
          fi
          npm install -g snyk >/dev/null 2>&1 || true
          # Exit 1 means issues were found.
          snyk code test --sarif-file-output=snyk-code.sarif 2>snyk-code.stderr || true
          if ! jq -e '.version and (.runs | type == "array")' snyk-code.sarif >/dev/null 2>&1; then
            echo '::warning::snyk code produced no valid SARIF; dropping the artifact'
            rm -f snyk-code.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: snyk-code
          path: snyk-code.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup zizmor

  zizmor:
    name: zizmor (GitHub Actions SAST)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Run zizmor
        continue-on-error: true
        env:
          GH_TOKEN: '${{ github.token }}'
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          set -uo pipefail
          # zizmor exits 14 when it has findings, which is a successful scan.
          uvx --from zizmor zizmor --format sarif . >zizmor.sarif 2>zizmor.stderr
          rc=$?
          if [ "$rc" -ne 0 ] && [ "$rc" -ne 14 ]; then
            echo "::warning::zizmor exited $rc"; sed -n '1,20p' zizmor.stderr
          fi
          if ! jq -e '.version and (.runs | type == "array")' zizmor.sarif >/dev/null 2>&1; then
            echo "::warning::zizmor produced no valid SARIF; dropping the artifact"
            rm -f zizmor.sarif
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: zizmor
          path: zizmor.sarif
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup cdxgen

  cdxgen:
    name: cdxgen (multi-ecosystem SBOM)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node.js
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Run cdxgen
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! find . -maxdepth 4 -type f \( -name package-lock.json -o -name go.mod -o -name requirements.txt -o -name pyproject.toml -o -name pom.xml -o -name build.gradle -o -name Cargo.lock -o -name composer.lock -o -name Gemfile.lock -o -name '*.csproj' \) -print | head -n 1 | grep -q .; then
            echo '::notice::no supported package manifest found; skipping cdxgen'
            exit 0
          fi
          npx --yes @cyclonedx/cdxgen -o cdxgen.cdx.json . || true
          if ! jq -e '.bomFormat == "CycloneDX"' cdxgen.cdx.json >/dev/null 2>&1; then
            echo '::warning::cdxgen produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cdxgen.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cdxgen
          path: cdxgen.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup cyclonedx-dotnet

  cyclonedx-dotnet:
    name: CycloneDX .NET SBOM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up .NET
        continue-on-error: true
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: 8.x
      - name: Generate .NET CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! find . -maxdepth 4 -type f \( -name '*.csproj' -o -name '*.sln' \) -print | head -n 1 | grep -q .; then
            echo '::notice::no .NET project found; skipping CycloneDX .NET'
            exit 0
          fi
          dotnet restore || true
          dotnet tool install --global CycloneDX
          export PATH="$PATH:$HOME/.dotnet/tools"
          dotnet-CycloneDX . -o . -json || true
          if [ -f bom.json ]; then
            mv bom.json cyclonedx-dotnet.cdx.json
          fi
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-dotnet.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx dotnet produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-dotnet.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-dotnet
          path: cyclonedx-dotnet.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup cyclonedx-go

  cyclonedx-go:
    name: CycloneDX Go SBOM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Go
        continue-on-error: true
        uses: actions/setup-go@v6
        with:
          go-version: stable
      - name: Generate Go CycloneDX SBOM
        continue-on-error: true
        env:
          GO_MODULE_PATTERN: '${{ vars.GO_MODULE_PATTERN }}'
          GO_MODULE_TOKEN: '${{ secrets.PACKAGES_TOKEN }}'
        shell: bash --noprofile --norc {0}
        run: |
          if [ -n "${GO_MODULE_TOKEN:-}" ]; then
            go env -w GOPRIVATE="${GO_MODULE_PATTERN:-github.com/$(echo "${GITHUB_REPOSITORY:-}" | cut -d/ -f1)/*}"
            git config --global url."https://x-access-token:${GO_MODULE_TOKEN}@github.com/".insteadOf "https://github.com/"
          fi
          if [ ! -f go.mod ]; then
            echo '::notice::no go.mod found; skipping CycloneDX Go'
            exit 0
          fi
          go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
          cyclonedx-gomod app -json -output cyclonedx-go.cdx.json . || true
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-go.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx go produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-go.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-go
          path: cyclonedx-go.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup cyclonedx-maven

  cyclonedx-maven:
    name: CycloneDX Maven (SBOM)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Java
        continue-on-error: true
        uses: actions/setup-java@v4
        with:
          cache: maven
          distribution: temurin
          java-version: 17
      - name: Generate Maven CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          set -uo pipefail
          if [ ! -f pom.xml ]; then
            echo '::notice::no pom.xml found; skipping CycloneDX Maven'
            exit 0
          fi
          mvn -B -q org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeAggregateBom \
            -DoutputFormat=json -DoutputName=cyclonedx-maven 2>cyclonedx-maven.stderr || true
          found=$(find . -name 'cyclonedx-maven.json' -print -quit)
          if [ -n "$found" ]; then
            cp "$found" cyclonedx-maven.cdx.json
          fi
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-maven.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx maven produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-maven.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-maven
          path: cyclonedx-maven.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup cyclonedx-node

  cyclonedx-node:
    name: CycloneDX npm SBOM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up Node.js
        continue-on-error: true
        uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
      - name: Generate npm CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f package-lock.json ]; then
            echo '::notice::no package-lock.json found; skipping CycloneDX npm'
            exit 0
          fi
          npm ci
          npx --yes @cyclonedx/cyclonedx-npm --omit dev --flatten-components --output-format JSON --output-file cyclonedx-node.cdx.json || true
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-node.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx npm produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-node.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-node
          path: cyclonedx-node.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup cyclonedx-php

  cyclonedx-php:
    name: CycloneDX PHP SBOM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up PHP
        continue-on-error: true
        uses: shivammathur/setup-php@v2
        with:
          php-version: 8.2
          tools: composer
      - name: Generate PHP CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if [ ! -f composer.lock ]; then
            echo '::notice::no composer.lock found; skipping CycloneDX PHP'
            exit 0
          fi
          composer require --dev cyclonedx/cyclonedx-php-composer || true
          composer CycloneDX:make-sbom --output-format=JSON --output-file=cyclonedx-php.cdx.json || true
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-php.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx php produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-php.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-php
          path: cyclonedx-php.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7

vulnetix gha setup cyclonedx-python

  cyclonedx-python:
    name: CycloneDX Python SBOM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Set up uv
        continue-on-error: true
        uses: astral-sh/setup-uv@v6
      - name: Generate Python CycloneDX SBOM
        continue-on-error: true
        shell: bash --noprofile --norc {0}
        run: |
          if ! command -v uvx >/dev/null 2>&1; then
            curl -LsSf https://astral.sh/uv/install.sh | sh >/dev/null 2>&1 || true
            export PATH="$HOME/.local/bin:$PATH"
          fi
          if ! command -v uvx >/dev/null 2>&1; then
            echo '::warning::uv is unavailable on this runner; skipping'
            exit 0
          fi
          # `cyclonedx-py environment` inventories the interpreter it runs under, which
          # under uvx is an isolated environment holding only cyclonedx-bom itself. Every
          # subcommand below reads a lockfile instead, so the SBOM describes the project.
          if [ -f poetry.lock ]; then
            uvx --from cyclonedx-bom cyclonedx-py poetry . \
              --output-format JSON --output-file cyclonedx-python.cdx.json || true
          elif [ -f Pipfile.lock ]; then
            uvx --from cyclonedx-bom cyclonedx-py pipenv . \
              --output-format JSON --output-file cyclonedx-python.cdx.json || true
          elif [ -f requirements.txt ]; then
            uvx --from cyclonedx-bom cyclonedx-py requirements requirements.txt \
              --output-format JSON --output-file cyclonedx-python.cdx.json || true
          else
            echo '::notice::no Python lockfile (poetry.lock, Pipfile.lock, requirements.txt); skipping CycloneDX Python'
            exit 0
          fi
          if ! jq -e '.bomFormat == "CycloneDX"' cyclonedx-python.cdx.json >/dev/null 2>&1; then
            echo '::warning::cyclonedx python produced no valid CycloneDX JSON; dropping the artifact'
            rm -f cyclonedx-python.cdx.json
          fi
      - uses: actions/upload-artifact@v6
        with:
          name: cyclonedx-python
          path: cyclonedx-python.cdx.json
          if-no-files-found: warn
          include-hidden-files: true
          retention-days: 7