# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Security Scan

on:
  workflow_dispatch:
    inputs:
      candidate_ref:
        description: Release tag to scan; Codex runs only for pre-release tags
        required: true
        type: string
      stable_ref:
        description: Optional previous stable tag override for Codex
        default: ""
        type: string
      allow_full_bootstrap:
        description: Allow a full Codex scan when no previous stable tag exists
        default: false
        type: boolean
      fail-on-codex-findings:
        description: Fail when Codex Security reports findings
        default: true
        type: boolean
      fail-on-static-findings:
        description: Fail when CodeQL, Trivy, or Zizmor reports HIGH/CRITICAL findings
        default: true
        type: boolean
      images:
        description: Newline-separated image references for Trivy
        default: ""
        type: string
      charts:
        description: Newline-separated packaged Helm chart OCI references for Trivy
        default: ""
        type: string
  workflow_call:
    inputs:
      candidate_ref:
        description: Release tag to scan; Codex runs only for pre-release tags
        required: true
        type: string
      stable_ref:
        description: Optional previous stable tag override for Codex
        default: ""
        type: string
      allow_full_bootstrap:
        description: Allow a full Codex scan when no previous stable tag exists
        default: false
        type: boolean
      fail-on-codex-findings:
        description: Fail when Codex Security reports findings
        default: true
        type: boolean
      fail-on-static-findings:
        description: Fail when CodeQL, Trivy, or Zizmor reports HIGH/CRITICAL findings
        default: true
        type: boolean
      images:
        description: Newline-separated image references for Trivy
        default: ""
        type: string
      charts:
        description: Newline-separated packaged Helm chart OCI references for Trivy
        default: ""
        type: string
    secrets:
      CODEX_SECURITY_API_KEY:
        required: true
      CACHIX_AUTH_TOKEN:
        required: false

permissions:
  contents: read

# Only the finding threshold is overridable; execution failures remain fatal.
jobs:
  codex:
    name: Codex Security
    if: contains(inputs.candidate_ref, '-pre.')
    uses: ./.github/workflows/codex-security.yml
    permissions:
      actions: read
      contents: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      stable_ref: ${{ inputs.stable_ref }}
      allow_full_bootstrap: ${{ inputs.allow_full_bootstrap }}
      fail-on-findings: ${{ inputs.fail-on-codex-findings }}
      upload_sarif: true
    secrets:
      CODEX_SECURITY_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}

  codeql:
    name: CodeQL
    uses: ./.github/workflows/codeql.yml
    permissions:
      contents: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      fail-on-findings: ${{ inputs.fail-on-static-findings }}

  trivy:
    name: Trivy
    uses: ./.github/workflows/trivy-scan.yml
    permissions:
      contents: read
      packages: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      fail-on-findings: ${{ inputs.fail-on-static-findings }}
      severity: HIGH,CRITICAL
      ignore-unfixed: false
      images: ${{ inputs.images }}
      charts: ${{ inputs.charts }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}

  cargo-deny:
    name: Cargo Deny
    uses: ./.github/workflows/cargo-deny.yml
    permissions:
      contents: read
      packages: read
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      advisories-only: true

  workflow-security:
    name: Actionlint and Zizmor
    uses: ./.github/workflows/workflow-security.yml
    permissions:
      contents: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      fail-on-findings: ${{ inputs.fail-on-static-findings }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}