name: Go Security

on:
  workflow_call:
    inputs:
      go-version-file:
        description: "Path to go.mod for version resolution"
        type: string
        default: "go.mod"

jobs:
  license:
    name: licence check (trivy)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Trivy
        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

      - name: Write Trivy config
        run: |
          {
            echo "scan:"
            echo "  scanners:"
            echo "    - license"
            echo "license:"
            echo "  forbidden:"
            echo "    - GPL-2.0"
            echo "    - GPL-3.0"
            echo "    - AGPL-3.0"
            echo "    - SSPL"
            echo "  restricted:"
            echo "    - LGPL-2.1"
            echo "    - LGPL-3.0"
          } > /tmp/trivy-license.yaml

      - name: Scan licences (full report)
        run: |
          trivy fs \
            --config /tmp/trivy-license.yaml \
            --format json \
            --output trivy-license-report.json \
            --exit-code 0 \
            .

      - name: Upload licence report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: trivy-license-report
          path: trivy-license-report.json
          retention-days: 7

      - name: Fail on forbidden licences
        run: |
          trivy fs \
            --config /tmp/trivy-license.yaml \
            --severity CRITICAL \
            --exit-code 1 \
            .

  vuln:
    name: vulnerability check (govulncheck)
    runs-on: ubuntu-latest
    env:
      GO_VERSION_FILE: ${{ inputs.go-version-file }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: ${{ env.GO_VERSION_FILE }}
          cache: true

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck
        run: govulncheck -json ./... > govulncheck-report.json

      - name: Upload vulnerability report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: govulncheck-report
          path: govulncheck-report.json
          retention-days: 7