deploy-DEV-linters.yml

---
#########################
#########################
## Deploy Docker Image Linters ##
#########################
#########################
# Documentation:
# https://help.github.com/en/articles/workflow-syntax-for-github-actions
#

#######################################
# Start the job on all push to main #
#######################################
name: "Build & Deploy - DEV linters"
on:
  pull_request:

###############
# Set the Job #
###############
concurrency:
  group: ${{ github.ref_name }}-${{ github.workflow }}
  cancel-in-progress: true

jobs:
  get-linters-matrix:
    name: Get Linters Matrix
    runs-on: ubuntu-latest
    outputs:
      linters: ${{ steps.set-matrix.outputs.linters }}
    steps:
      - name: Checkout Code
        uses: actions/checkout@v6
      - name: Get PR title or commit message
        id: get-title
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            echo "title=${{ github.event.pull_request.title }}" >> $GITHUB_OUTPUT
          else
            echo "title=${{ github.event.head_commit.message }}" >> $GITHUB_OUTPUT
          fi
      - name: Read linters_matrix.json and filter
        id: set-matrix
        run: |
          extract_pkg() {
            # Extract after 'upgrade', 'update dependency', 'update docker tag', etc.
            pkg=$(echo "$1" | sed -E 's/^chore\(deps\): (upgrade|update dependency|update docker tag|update .* plugin|update .* docker tag) ([^ ]+).*/\2/i')
            # If not found, try generic extraction for dependency lines
            if [ -z "$pkg" ]; then
              pkg=$(echo "$1" | sed -E 's/^chore\(deps\): update dependency ([^ ]+).*/\1/i')
            fi
            # Extract last segment after / or @ (e.g., friendsofphp/php-cs-fixer -> php-cs-fixer, @salesforce/plugin-packaging -> plugin-packaging)
            pkg=$(echo "$pkg" | sed -E 's/^.*[\/@]//')
            # Normalize: replace - and / with _, lowercase
            pkg=$(echo "$pkg" | sed 's/@//g; s/[-\/]/_/g' | tr '[:upper:]' '[:lower:]')
            echo "$pkg"
          }
          title="${{ steps.get-title.outputs.title }}"
          echo "title=$title"
          matrix=$(cat .automation/generated/linters_matrix.json | jq -c)
          pkg=$(extract_pkg "$title")
          echo "Extracted package: $pkg"
          if [ -n "$pkg" ] && echo "$title" | grep -iq '^chore(deps)'; then
            matches=$(echo "$matrix" | jq -c --arg pkg "$pkg" '[.[] | select(tostring | match($pkg;"i"))]')
            if [ "$(echo "$matches" | jq 'length')" -gt 0 ]; then
              echo "Filtered linters: $matches"
              echo "linters=$matches" >> $GITHUB_OUTPUT
              exit 0
            fi
          fi
          # Default: return all
          echo "No specific package found or not a chore(deps) commit, using all linters."
          echo "linters=$matrix" >> $GITHUB_OUTPUT

  build:
    # Name the Job
    name: DEV/Linters
    # Set the agent to run on
    runs-on: ubuntu-latest
    needs: get-linters-matrix
    permissions: read-all
    strategy:
      fail-fast: false
      max-parallel: 18
      matrix:
        linter: ${{ fromJson(needs.get-linters-matrix.outputs.linters) }}
        platform: ["linux/amd64"]
    # Only run this on the main repo
    if: |
      (
      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'push' && github.repository == 'oxsecurity/megalinter')
      )
      && !contains(github.event.head_commit.message, 'skip deploy')
      && !contains(github.event.head_commit.message, 'skip linters')

    ##################
    # Load all steps #
    ##################
    steps:
      - name: Checkout Code
        uses: actions/checkout@v6

      - name: Docker Metadata action
        uses: docker/metadata-action@v6
        id: meta
        with:
          images: |
            ${{ github.repository }}-only-${{ matrix.linter }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
        if: ${{ ( ( runner.arch != 'X64' || runner.os != 'Linux' ) && matrix.platform == 'linux/amd64' ) || matrix.platform != 'linux/amd64' }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build Image
        uses: docker/build-push-action@v7
        with:
          context: .
          file: linters/${{ matrix.linter }}/Dockerfile
          platforms: ${{ matrix.platform }}
          build-args: |
            BUILD_DATE=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
            BUILD_VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}
            BUILD_REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
          load: true
          push: false
          secrets: |
            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
          tags: ${{ steps.meta.outputs.tags }}

      #####################################
      # Run Linter test cases #
      #####################################
      - name: Run Test Cases
        shell: bash
        run: |
          GITHUB_REPOSITORY=$([ "${{ github.event_name }}" == "pull_request" ] && echo "${{ github.event.pull_request.head.repo.full_name }}" || echo "${{ github.repository }}")
          GITHUB_BRANCH=$([ "${{ github.event_name }}" == "pull_request" ] && echo "${{ github.head_ref }}" || echo "${{ github.ref_name }}")

          TEST_KEYWORDS_TO_USE_UPPER="${{ matrix.linter }}"
          TEST_KEYWORDS_TO_USE="${TEST_KEYWORDS_TO_USE_UPPER,,}"
          docker image ls
          docker run -e TEST_CASE_RUN=true -e OUTPUT_FORMAT=text -e OUTPUT_FOLDER=${{ github.sha }} -e OUTPUT_DETAIL=detailed -e GITHUB_SHA=${{ github.sha }} -e GITHUB_REPOSITORY=${GITHUB_REPOSITORY} -e GITHUB_BRANCH=${GITHUB_BRANCH} -e GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}" -e TEST_KEYWORDS="${TEST_KEYWORDS_TO_USE}" -e MEGALINTER_VOLUME_ROOT="${GITHUB_WORKSPACE}" -v "/var/run/docker.sock:/var/run/docker.sock:rw" -v ${GITHUB_WORKSPACE}:/tmp/lint ${{ fromJson(steps.meta.outputs.json).tags[0]}}
        timeout-minutes: 30

      ##############################################
      # Check Docker image security with Trivy #
      ##############################################
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "${{ fromJson(steps.meta.outputs.json).tags[0] }}"
          format: "table"
          exit-code: "1"
          ignore-unfixed: true
          scanners: vuln
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"
          timeout: 10m0s
        env:
            ACTIONS_RUNTIME_TOKEN: ${{ secrets.GITHUB_TOKEN }}