# SPDX-License-Identifier: MPL-2.0
# Read-only corpus audits, NOT consumer deployment or consumer PR validation.
# Execute only pinned suite scripts; never execute code from a subject repo.
name: Secret scanner consumer canaries
on:
  pull_request:
    paths:
      - '.github/workflows/secret-scanner-consumer-canaries.yml'
      - 'config/gitleaks/consumer-canaries.json'
  workflow_dispatch:
permissions:
  contents: read
concurrency:
  group: scanner-consumer-canaries-${{ github.ref }}
  cancel-in-progress: true
jobs:
  plan:
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      subjects: ${{ steps.plan.outputs.subjects }}
      suite_sha: ${{ steps.plan.outputs.suite_sha }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Validate bounded immutable manifest and published suite pin
        id: plan
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          manifest=config/gitleaks/consumer-canaries.json
          jq -e '
            .schema_version == 1 and
            (.suite_sha | test("^[0-9a-f]{40}$")) and
            (.subjects | length >= 1 and length <= 5) and
            all(.subjects[];
              (.repository | test("^hyperpolymath/[A-Za-z0-9_.-]+$")) and
              (.sha | test("^[0-9a-f]{40}$")))
          ' "$manifest" >/dev/null
          sha=$(jq -r .suite_sha "$manifest")
          bash scripts/verify-published-scanner-pin.sh "$sha"
          echo "suite_sha=$sha" >> "$GITHUB_OUTPUT"
          echo "subjects=$(jq -c .subjects "$manifest")" >> "$GITHUB_OUTPUT"
  audit:
    needs: plan
    name: Audit ${{ matrix.subject.repository }}
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    strategy:
      fail-fast: false
      max-parallel: 3
      matrix:
        subject: ${{ fromJSON(needs.plan.outputs.subjects) }}
    steps:
      - name: Check out immutable published subject (read only)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ matrix.subject.repository }}
          ref: ${{ matrix.subject.sha }}
          path: subject
          fetch-depth: 0
          persist-credentials: false
      - name: Check out published scanner implementation outside subject
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: hyperpolymath/cicd-suite
          ref: ${{ needs.plan.outputs.suite_sha }}
          path: suite
          persist-credentials: false
      - name: Verify both checkouts and install pinned scanner
        shell: bash
        env:
          SUBJECT_SHA: ${{ matrix.subject.sha }}
          SUITE_SHA: ${{ needs.plan.outputs.suite_sha }}
        run: |
          set -euo pipefail
          [[ $(git -C subject rev-parse HEAD) == "$SUBJECT_SHA" ]] || exit 2
          [[ $(git -C suite rev-parse HEAD) == "$SUITE_SHA" ]] || exit 2
          bash suite/actions/secret-scan-check/install.sh "$RUNNER_TEMP/canary-gitleaks"
      - name: Audit full history, tree and supplemental populations
        shell: bash
        env:
          SUBJECT: ${{ github.workspace }}/subject
          GITLEAKS_BIN: ${{ runner.temp }}/canary-gitleaks/gitleaks
          ESTATE_BASELINE: ${{ github.workspace }}/suite/config/gitleaks/estate-baseline.toml
          SCAN_MODE: full
          SCAN_TIMEOUT_SECONDS: '180'
        run: |
          set -euo pipefail
          # This is an offline audit of a published consumer default-branch
          # snapshot, not a scan of the cicd-suite PR base/head. Clear that
          # unrelated caller event context for this child process only.
          # Scanner controls and all finding/infrastructure failures enforce.
          env -u GITHUB_EVENT_NAME -u PR_BASE -u PR_HEAD \
            bash suite/actions/secret-scan-check/check.sh