name: secyourit
on:
  workflow_call:
    inputs:
      signerID:
        required: false
        type: string
      org:
        required: false
        type: string
      path:
        required: true
        type: string
      language:
        required: true
        type: string
    secrets:
      SNYK_API_TOKEN:
        required: true

jobs:
  hola-secyourit:
    name: "Welcome to SecyourIT"
    runs-on: ubuntu-latest
    steps:
      - name: Project Init
        run: echo "SecyourIT says Hi!"

  find-secrets:
    name: 'Scan for Secrets'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Find Secrets
        uses: max/secret-scan@master
        with:
          exclude_path: '.github/workflows/configuration/exclude_paths.txt'

  verify-commits-using-notary:
    name: Verify Commits using Notary
    runs-on: ubuntu-latest
    steps:
      - uses: vchain-us/verify-action@master
        with:
          signerID: ${{inputs.signerID}}
          org: ${{inputs.org}}
          path: ${{inputs.path}}

  scan-image-using-trivy:
    name: Trivy Scan Image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Scan File system suing Trivy
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH,MEDIUM'

  sca-using-snyk:
    name: Software Compositon Analysis using Snyk
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/${{inputs.language}}@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_API_TOKEN }}

  sast-using-appthreat:
    name: SAST using AppThreat
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Run SAST Scan by AppThreat
        uses: AppThreat/sast-scan-action@master
        with:
          type: ${{inputs.language}}