cve-scan-pr.yml

name: HMDA PR CVE Scan

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  pull-requests: write

jobs:
  hmda-platform-cve-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repo
        uses: actions/checkout@v4

      - name: Build Docker image of HMDA platform
        run: |
          env JAVA_OPTS="-Xss256m -Xmx4096m" sbt "project hmda-platform" dockerPublishLocalSkipTests
        continue-on-error: false

      - name: Tag and name Docker image
        run: docker tag hmda/hmda-platform:latest pr-cve-scan:latest

      - name: Set up Homebrew
        uses: Homebrew/actions/setup-homebrew@master

      - name: Install Grype
        run: |
          brew install grype

      - name: Run Grype scan
        run: |
          grype pr-cve-scan:latest > grype-report.txt
          
      - name: Upload Grype report to artifact
        uses: actions/upload-artifact@v4
        with:
          name: cve-report
          path: |
            grype-report.txt

      - name: Post comment with report link
        uses: thollander/actions-comment-pull-request@v3
        with:
          message: CVE scan report generated by Grype are available. Check the Actions tab to download the reports.

      - name: Remove Docker image
        run: |
          docker rmi pr-cve-scan:latest