rl-secure.yml

name: RL-Secure Workflow
run-name: rl-scanner

on:
  workflow_call:
    inputs:
      nuspec-file:
        type: string        
        required: true
      artifact-name:
        type: string
        required: true
      project-path:
        type: string
        required: true
    secrets:
      RLSECURE_LICENSE:
        required: true
      RLSECURE_SITE_KEY:
        required: true
      SIGNAL_HANDLER_TOKEN:
        required: true
      PRODSEC_TOOLS_USER:
        required: true
      PRODSEC_TOOLS_TOKEN:
        required: true
      PRODSEC_TOOLS_ARN:
        required: true

jobs:
  rl-scanner:
    name: Run Reversing Labs scanner
    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
    runs-on: ubuntu-latest
    outputs:
      scan-status: ${{ steps.rl-scan-conclusion.outcome }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: '8.0.404'

      - name: Setup Mono
        run: |
          sudo apt-get update
          sudo apt-get install -y mono-complete

      - name: Setup NuGet
        uses: nuget/setup-nuget@v1

      - uses: actions/download-artifact@v4
        with:
          path: './src'
          name: build

      - name: Create NuGet packages
        shell: pwsh
        run: |
            nuget pack ${{ inputs.nuspec-file }} -OutputDirectory ${{ github.workspace }}/nuget

      - name: Create tgz build artifact
        run: |
          tar -czvf ${{ github.workspace }}/${{ inputs.artifact-name }} ${{ github.workspace }}/nuget

      - id: get_version
        uses: ./.github/actions/get-version
        with:
          working-directory: ${{ inputs.project-path }}

      - name: Run RL Scanner
        id: rl-scan-conclusion
        uses: ./.github/actions/rl-scanner
        with:
          artifact-path: ${{ github.workspace }}/${{ inputs.artifact-name }}
          version: "${{ steps.get_version.outputs.version }}"
        env:
          RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
          RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
          SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
          PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
          PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
          PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
        
      - name: Output scan result
        run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV