name: Release Vulnerability Check
on:
  workflow_dispatch: {}
  schedule:
    - cron:  '0 8 * * 0-4' # Sun-Thu, at 8:00 UTC

permissions:
  contents: read

env:
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}

jobs:
  fetch-release-info:
    name: Fetch release information
    runs-on: ubuntu-24.04
    outputs:
      release_tag: ${{ steps.release.outputs.release_tag }}
    steps:
      - name: Fetch latest release tag
        id: release
        run: |
          LATEST_RELEASE=$(curl -s https://api.github.com/repos/open-policy-agent/opa/releases/latest | jq -r .tag_name)
          echo "release_tag=${LATEST_RELEASE}" >> $GITHUB_OUTPUT
          echo "### 🔍 Release Vulnerability Checks" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Checking vulnerabilities for:" >> $GITHUB_STEP_SUMMARY
          echo "- **Release**: [${LATEST_RELEASE}](https://github.com/open-policy-agent/opa/releases/tag/${LATEST_RELEASE})" >> $GITHUB_STEP_SUMMARY

  govulncheck-latest-release:
    name: Go vulnerability check (latest release)
    runs-on: ubuntu-24.04
    needs: fetch-release-info
    steps:
      - name: Check out latest release
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ needs.fetch-release-info.outputs.release_tag }}
          persist-credentials: false

      - name: Check out main for build/tools
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          path: opa
          persist-credentials: false

      - name: Install Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: .go-version

      - run: cd opa/build/tools && go install tool
      - run: govulncheck ./...

      - name: Slack Notification
        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
        if: failure() && env.SLACK_WEBHOOK_URL != ''
        with:
          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
              "text": "Vulnerabilities found in ${{ needs.fetch-release-info.outputs.release_tag }}: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
            }
