sbom-diff-and-risk-code-scanning.yml

name: sbom-diff-and-risk-code-scanning
run-name: sbom-diff-and-risk code scanning / ${{ github.event_name }} / ${{ github.ref_name }}

on:
  workflow_dispatch:
  pull_request:
    paths:
      - ".github/workflows/sbom-diff-and-risk-code-scanning.yml"
      - "tools/sbom-diff-and-risk/**"

permissions: {}

env:
  SBOM_DIFF_RISK_PYTHON_VERSION: "3.11"
  SBOM_DIFF_RISK_SARIF_ARTIFACT_NAME: sbom-diff-and-risk-sarif
  SBOM_DIFF_RISK_SARIF_CATEGORY: sbom-diff-risk/example
  SBOM_DIFF_RISK_SARIF_FILE: outputs/report.sarif

jobs:
  upload-sarif:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    defaults:
      run:
        working-directory: tools/sbom-diff-and-risk
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.SBOM_DIFF_RISK_PYTHON_VERSION }}

      - name: Upgrade pip
        run: python -m pip install --upgrade pip

      - name: Install sbom-diff-and-risk
        run: python -m pip install -e .[dev]

      - name: Generate SARIF report
        run: |
          mkdir -p outputs
          python -m sbom_diff_risk.cli compare \
            --before examples/sarif_before.json \
            --after examples/sarif_after.json \
            --out-sarif ${{ env.SBOM_DIFF_RISK_SARIF_FILE }}

      - name: Upload SARIF workflow artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ env.SBOM_DIFF_RISK_SARIF_ARTIFACT_NAME }}
          path: tools/sbom-diff-and-risk/${{ env.SBOM_DIFF_RISK_SARIF_FILE }}
          if-no-files-found: error

      - name: Upload SARIF to code scanning
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: tools/sbom-diff-and-risk/${{ env.SBOM_DIFF_RISK_SARIF_FILE }}
          category: ${{ env.SBOM_DIFF_RISK_SARIF_CATEGORY }}