pr_diff.yml

name: Send PR and Check for Secrets

on:
  pull_request:
    branches:
      - main

jobs:
  send_pr_diff_and_check_for_secrets:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js environment
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install axios
        run: npm install axios

      - name: Get PR Diff
        id: get_pr_diff
        run: |
          echo "Fetching PR diff..."
          curl -s "${{ github.event.pull_request.diff_url }}" -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" > pr_diff.txt
          echo "PR diff content fetched."

      - name: Get sat_token
        id: get_sat_token
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const axios = require('axios');

            let config = {
              method: 'post',
              maxBodyLength: Infinity,
              url: 'https://sat-ci.codebig2.net/v2/oauth/token', // Replace with the actual URL
              headers: {
                'X-Client-Id': 'ccs-spider-xgitguard',
                'X-Client-Secret': '3bd4ace7c97584e63c172d160aef1830', // Replace with the actual secret
                'Content-Type': 'application/json'
              }
            };

            axios.request(config)
              .then((response) => {
                if (response.status === 200) {
                  const data = response.data;
                  const accessToken = data.access_token;
                  const scope = data.scope;
                  const tokenType = data.token_type;

                  console.log(`Access Token: ${accessToken}`);
                  console.log(`Scope: ${scope}`);
                  console.log(`Token Type: ${tokenType}`);

                  // Set outputs for future steps
                  core.setOutput('sat_token', accessToken);
                  core.setOutput('scope', scope);
                  core.setOutput('token_type', tokenType);

                  // Export environment variables for current step
                  core.exportVariable('SAT_TOKEN', accessToken);
                  core.exportVariable('SCOPE', scope);
                  core.exportVariable('TOKEN_TYPE', tokenType);
                } else {
                  console.log(`Unexpected status code: ${response.status}`);
                  core.setFailed(`Unexpected status code: ${response.status}`);
                }
              })
              .catch((error) => {
                console.log(`Error occurred: ${error.message}`);
                core.setFailed(`Failed to get SAT token: ${error.message}`);
              });

      - name: Send PR Diff to Queue
        id: send_pr_diff_queue
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const axios = require('axios');

            const apiUrl = 'https://plain-ends-brake.loca.lt/api/v1/xgg/queue/send_data';
            const diffUrl = 'https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}';
            const number = '${{ github.event.pull_request.number }}';
            const repo = '${{ github.event.repository.name }}';
            const owner = '${{ github.event.pull_request.user.login }}';
            const githubToken = '${{ secrets.GITHUB_TOKEN }}';
            const headSha = '${{ github.event.pull_request.head.sha }}';
            const satToken = '${{ steps.get_sat_token.outputs.sat_token }}';
            const scope = '${{ steps.get_sat_token.outputs.scope }}';
            const organization = '${{ github.repository_owner }}';
            const tokenType = '${{ steps.get_sat_token.outputs.token_type }}'; // Removed the extra quote

            const requestData = {
              diff_url: diffUrl,
              number: number,
              repo: repo,
              owner: owner,
              github_token: githubToken,
              head_sha: headSha,
              organization: organization
            };

            try {
              const response = await axios.post(apiUrl, requestData, {
                headers: {
                  'Content-Type': 'application/json',
                  'Authorization': `Bearer ${satToken}`
                }
              });
              const data = response.data;

              // Handle API response
              if (data.status === 'error') {
                core.setFailed(`API Error: ${data.message}`);
              } else if (data.status === 'success') {
                core.setOutput('message', 'Diff data sent to the queue successfully');
                core.setOutput('scan_audit_id', data.scan_audit_id);
                console.log(data.scan_audit_id);
              } else {
                console.log('API response is OK.');
              }
            } catch (error) {
              core.setFailed(`API request failed: ${error.message}`);
            }

      - name: Print scan_audit_id and apiUrl
        id: print_scan_audit_id
        run: |
          echo "scan_audit_id: ${{ steps.send_pr_diff_queue.outputs.scan_audit_id }}"
          echo "apiUrl: https://plain-ends-brake.loca.lt/api/v1/xgg/secret_scan/status/${{ steps.send_pr_diff_queue.outputs.scan_audit_id }}"

      - name: Check for scan status
        id: get_scan_status
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const axios = require('axios');
            const scanAuditId = '${{ steps.send_pr_diff_queue.outputs.scan_audit_id }}';
            const apiUrl = 'https://plain-ends-brake.loca.lt/api/v1/xgg/secret_scan/status/${{ steps.send_pr_diff_queue.outputs.scan_audit_id }}';
            const satToken = '${{ steps.get_sat_token.outputs.sat_token }}';

            const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
            try {
              let res;
              do {
                const response = await axios.get(apiUrl, {
                  headers: {
                    'Content-Type': 'application/json',
                    'Authorization': `Bearer ${satToken}`
                  }
                });
                res = response.data;
                console.log(res);
                console.log(res.data.status);

                // Handle API response
                if (res.data.status === 'Completed') {
                  console.log('API response is completed.');
                } else {
                  console.log('API response is not completed. Retrying in 10 seconds...');
                  await delay(10000); // Wait for 10 seconds before the next API call
                }
              } while (res.data.status !== 'Completed');
            } catch (error) {
              core.setFailed(`API request failed: ${error.message}`);
            }

      - name: Check for secrets
        id: check_secrets
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const axios = require('axios');
            const scanAuditId = '${{ steps.send_pr_diff_queue.outputs.scan_audit_id }}';
            const apiUrl = 'https://plain-ends-brake.loca.lt/api/v1/xgg/check_secrets/${{ steps.send_pr_diff_queue.outputs.scan_audit_id }}';
            const satToken = '${{ steps.get_sat_token.outputs.sat_token }}';


            try {
              const response = await axios.get(apiUrl, {
                headers: {
                  'Content-Type': 'application/json',
                  'Authorization': `Bearer ${satToken}`
                }
              });
              const data = response.data;
              console.log(data);

              // Handle API response
              if (data.status === 'error') {
                core.setFailed(`API Error: ${data.message}`);
              } else if (data.status == 'success'){
                core.setOutput('message', 'No secrets found');
              } else if (data.status === 'warning') {
                if (Array.isArray(data.warning_messages)) {
                  // Iterate over the list and issue warnings
                  data.warning_messages.forEach(message => {
                    core.warning(`Warning: ${message}`);
                  });
                  core.setFailed('Secrets found in PR');
                } else {
                  core.warning('Unknown warning format');
                }
              } else {
                console.log('API response is OK.');
              }
            } catch (error) {
              core.setFailed(`API request failed: ${error.message}`);
            }