scan-and-report.yml

# SPDX-License-Identifier: PMPL-1.0-or-later

name: Scan and Report to VeriSimDB

on:
  workflow_call:
    inputs:
      repo_path:
        description: 'Path to scan (default: .)'
        default: '.'
        type: string
    secrets:
      VERISIMDB_PAT:
        description: 'PAT with repo scope for cross-repo dispatch to verisimdb-data'
        required: false
  workflow_dispatch:

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

      - name: Install Rust
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7  # stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2

      - name: Install panic-attack
        run: |
          cargo install --git https://github.com/hyperpolymath/panic-attacker --branch main

      - name: Run scan
        id: scan
        run: |
          panic-attack assail ${{ inputs.repo_path }} --output scan-result.json
          echo "scan_complete=true" >> $GITHUB_OUTPUT

      - name: Send to verisimdb-data
        if: steps.scan.outputs.scan_complete == 'true'
        env:
          DISPATCH_TOKEN: ${{ secrets.VERISIMDB_PAT || secrets.GITHUB_TOKEN }}
        run: |
          REPO_NAME=$(basename $(pwd))
          SCAN_DATA=$(cat scan-result.json)

          curl -sf -X POST \
            -H "Authorization: Bearer ${DISPATCH_TOKEN}" \
            -H "Accept: application/vnd.github+json" \
            "https://api.github.com/repos/hyperpolymath/verisimdb-data/dispatches" \
            -d "{\"event_type\":\"scan_result\",\"client_payload\":{\"repo_name\":\"$REPO_NAME\",\"scan_data\":$SCAN_DATA}}"
          echo "Dispatched scan results for ${REPO_NAME} to verisimdb-data"