scheduled-scan.yml

# Copyright the Hyperledger Fabric contributors. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: "Scheduled vulnerability scan"

on:
  schedule:
    - cron: "20 3 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  latest-release-version:
    name: Get latest release tag
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      tag_name: ${{ steps.tag-name.outputs.value }}
    steps:
      - id: tag-name
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          tag="$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq '.tag_name')"
          if [ -z "${tag}" ] || [ "${tag}" = "null" ]; then
            echo "::error::No releases found in ${GITHUB_REPOSITORY}"
            exit 1
          fi
          echo "value=${tag}" >> "${GITHUB_OUTPUT}"

  scan-release:
    name: Scan ${{ needs.latest-release-version.outputs.tag_name }}
    needs: latest-release-version
    uses: ./.github/workflows/scan.yml
    with:
      ref: ${{ needs.latest-release-version.outputs.tag_name }}

  # This job runs on the `main` branch and scans the `main` branch at the default branch's HEAD. 
  # Without it, vulnerabilities introduced in `main`
  # but not yet released would go unnoticed until the next release.
  scan-latest:
    name: Scan latest
    uses: ./.github/workflows/scan.yml