[BUG] sansec ecomscan workflow should be removed from this repo

[damienwebdev]

@sprankhub Given the nature of this repo, I think we should remove the ecomscan workflow.

Additionally #333

This repo should be excluded from terraform.

[sprankhub]

I am not sure if I follow along. The current terraform-managed workflow .github/workflows/sansec-ecomscan.yml scans the repository it resides for malware. This does make sense for any repository, doesn't it? Why do you think this repo should be excluded?

If I understand you correctly, you also want to enable others to execute this workflow anywhere they want?

Sorry if I am missing something obvious here, but I really need some more information.

[damienwebdev]

Sorry for my first response. I wasn't particularly clear.

This repo has a deliberate two-tier workflow naming convention:

• .github/workflows/<name>.yaml — public reusable workflows that downstream callers consume (integration.yaml, check-extension.yaml, nx-integration-tests.yml, etc.)
• .github/workflows/_internal-<name>.yaml — private workflows that exercise this repo's own CI (_internal-coding-standard.yaml, _internal-setup-magento.yaml, _internal-unit.yaml, …)

The terraform-pushed .github/workflows/sansec-ecomscan.yml lands in the public namespace by filename but is private in intent. It scans this repo itself, with no external callers. That mismatch is what I had in mind: this repo is a few select private workflows alongside primarily public-facing actions, and a terraform-managed sansec-ecomscan.yml reads as a public reusable workflow that it isn't.

I am not proposing to stop scanning this repo. I am proposing that the scanning be owned by this repo, in the same _internal- namespace as the rest of its own CI, rather than pushed in by terraform.

#333 already proposes both halves of the replacement:

1. A new action at mage-os/github-actions/sansec-ecomscan (the wget/chmod/run logic, packaged so it can be reused).
2. A thin internal caller workflow that consumes it.

One correction on #333's body: the workflow path should be .github/workflows/_internal-sansec-ecomscan.yml to match the convention above (I'll update the issue). With that, this repo continues to be scanned on every push/PR — just via its own _internal- workflow, consistent with the existing pattern.

This unblocks a two-step migration in mage-os/terraform:

Step 1

Exclude github-actions from the for_each** so terraform stops pushing a duplicate workflow into a repo that defines its own:

resource "github_repository_file" "sansec_ecomscan_workflow" {
  for_each = {
    for k, v in var.repositories : k => v
    if !github_repository.repositories[k].archived && k != "github-actions"
  }
  ...
}

Step 2 (follow-up, after #333 ships and the action proves out)

Swap the inlined steps in the terraform-pushed workflow for a thin caller of the new action, so there's a single source of truth for the scan logic:

steps:
  - uses: actions/checkout@v6
    with:
      ref: $${{ github.event.pull_request.head.sha }}
      persist-credentials: false
  - uses: mage-os/github-actions/sansec-ecomscan@main
    with:
      ecomscan_key: $${{ secrets.SANSEC_LICENSE_KEY }}

In order of operations, I'd probably do:

1. Merge [MAINT] Github Actions Reunification - sansec-ecomscan #333 (action + _internal-sansec-ecomscan.yml).
2. In the same window, merge the Step 1 terraform exclusion.
3. Once the action has run cleanly in a couple of consumer repos, follow up with the Step 2 body-swap.

That avoids any window where this repo is unscanned.

Does that clarify things? Happy to open the terraform PR as well once #333 is finalized.

[sprankhub]

Thanks, that's a lot clearer now. Works for me. It sounds like you'll implement all this, so I will unassign myself from this issue.