stage-1-commit.yaml

name: 'Commit stage'

on:
  workflow_call:
    inputs:
      build_datetime:
        description: 'Build datetime, set by the CI/CD pipeline workflow'
        required: true
        type: string
      build_timestamp:
        description: 'Build timestamp, set by the CI/CD pipeline workflow'
        required: true
        type: string
      build_epoch:
        description: 'Build epoch, set by the CI/CD pipeline workflow'
        required: true
        type: string
      nodejs_version:
        description: 'Node.js version, set by the CI/CD pipeline workflow'
        required: true
        type: string
      python_version:
        description: 'Python version, set by the CI/CD pipeline workflow'
        required: true
        type: string
      terraform_version:
        description: 'Terraform version, set by the CI/CD pipeline workflow'
        required: true
        type: string
      version:
        description: 'Version of the software, set by the CI/CD pipeline workflow'
        required: true
        type: string

jobs:
  scan-secrets:
    name: 'Scan secrets'
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: 'Checkout code'
        with:
          # By default, the checkout action just checks out the latest commit, creating a "shallow" clone.
          # If we only scanned the latest commit, we might miss leaks that are not in the latest commit
          # but are still present in previous commits on the branch.
          #
          # We don't want to checkout (and scan) the entire repository though, because that would mean
          # 'bad' commits (including false-positives) block the CI for unrelated PRs, even if they're not
          # on main, or part of the new branch.
          #
          # To keep PRs independent of each other, we can fetch with an "infinite" depth, rather than
          # the special 0 value of actions/checkout, which means "fetch all history for all tags and branches"
          fetch-depth: 0x7fffffff # INFINITE_DEPTH
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: 'Scan secrets'
        uses: ./.github/actions/scan-secrets
  scan-dependencies:
    name: 'Scan dependencies'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    timeout-minutes: 2
    steps:
      - name: 'Checkout code'
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: 'Scan dependencies'
        uses: ./.github/actions/scan-dependencies
        with:
          build_datetime: '${{ inputs.build_datetime }}'
          build_timestamp: '${{ inputs.build_timestamp }}'
          idp_aws_report_upload_account_id: '${{ secrets.IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID }}'
          idp_aws_report_upload_region: '${{ secrets.IDP_AWS_REPORT_UPLOAD_REGION }}'
          idp_aws_report_upload_role_name: '${{ secrets.IDP_AWS_REPORT_UPLOAD_ROLE_NAME }}'
          idp_aws_report_upload_bucket_endpoint: '${{ secrets.IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT }}'