action.yml

---
name: 'Escape CLI'
author: 'Escape Technologies'
description: 'Run the Escape CLI in GitHub Actions.'

inputs:
  profile_id:
    description: 'The id of the profile to scan'
    required: true
  api_key:
    description: 'Your escape api key'
    required: true
  configuration_override:
    description: 'Partial JSON configuration for the scan'
    required: false
  schema:
    description: 'The schema local path or publicly accessible URL. If provided, it will update the schema for the application'
    required: false
  watch:
    description: 'Wait until the scan ends and print the results'
    required: false
    default: 'false'
  cli_image:
    description: 'Override the CLI Docker image. Defaults to the released version.'
    required: false

  # Deprecated
  timeout:
    description: 'Maximum blocking time for a CI/CD run'
    required: false
    deprecationMessage: 'Deprecated'
  configuration_override_path:
    description: 'Path to JSON file containing a partial configuration for the scan'
    required: false
    deprecationMessage: 'Deprecated, use configuration_override instead'
  introspection_file:
    description: 'Path to the introspection response file'
    required: false
    deprecationMessage: 'Deprecated, use schema instead'
  schema_file:
    description: 'Path to the schema file'
    required: false
    deprecationMessage: 'Deprecated, use schema instead'
  fail_on_severities:
    description: 'A csv-delimited list of severities to fail on, can be CRITICAL, HIGH, MEDIUM, LOW, INFO. Wired to --fail-on-severity: the least severe listed level becomes the floor (watch mode only)'
    default: 'HIGH'
    required: false
    deprecationMessage: 'Deprecated, superseded by the --fail-on-severity flag of scans start'
runs:
  using: composite
  steps:
    - name: Escape scan
      shell: bash
      env:
        ESCAPE_API_KEY: ${{ inputs.api_key }}
        INPUT_PROFILE_ID: ${{ inputs.profile_id }}
        ESCAPE_WATCH: ${{ inputs.watch }}
        ESCAPE_CONFIGURATION_OVERRIDE: ${{ inputs.configuration_override }}
        ESCAPE_SCHEMA: ${{ inputs.schema }}
        ESCAPE_CLI_IMAGE_OVERRIDE: ${{ inputs.cli_image }}
        INPUT_FAIL_ON_SEVERITIES: ${{ inputs.fail_on_severities }}
        GH_ACTION_REF: ${{ github.action_ref }}
      run: |
        set -euo pipefail
        GH_ACTION_REF="${GH_ACTION_REF#v}"
        ESCAPE_CLI_IMAGE="${ESCAPE_CLI_IMAGE_OVERRIDE:-docker.io/escapetech/cli:${GH_ACTION_REF:-latest}}"
        PROFILE_ID="${INPUT_PROFILE_ID:-}"
        if [ -z "${PROFILE_ID}" ]; then
          echo "profile_id is not set"
          exit 1
        fi
        if [ -z "${ESCAPE_API_KEY}" ]; then
          echo "api_key input is not set"
          exit 1
        fi
        run_cli() {
          docker run --rm -e ESCAPE_API_KEY "${ESCAPE_CLI_IMAGE}" "$@"
        }
        if [ -n "${ESCAPE_SCHEMA}" ]; then
          echo "Updating schema"
          run_cli profiles update-schema "${PROFILE_ID}" "${ESCAPE_SCHEMA}"
        fi
        args=(scans start "${PROFILE_ID}")
        if [ "${ESCAPE_WATCH}" = "true" ]; then
          args+=(--watch)
        fi
        # fail_on_severities is deprecated but still honored. --fail-on-severity
        # takes one floor severity, so a list maps to its least severe entry:
        # an issue at or above that level fails the run. Only meaningful with
        # watch=true, which the flag requires on scans start.
        if [ "${ESCAPE_WATCH}" = "true" ] && [ -n "${INPUT_FAIL_ON_SEVERITIES}" ]; then
          floor=""
          floor_rank=5
          read -ra severities <<< "$(echo "${INPUT_FAIL_ON_SEVERITIES}" | tr ',' ' ')"
          for sev in "${severities[@]}"; do
            sev="$(echo "${sev}" | tr '[:lower:]' '[:upper:]')"
            case "${sev}" in
              INFO)     rank=0 ;;
              LOW)      rank=1 ;;
              MEDIUM)   rank=2 ;;
              HIGH)     rank=3 ;;
              CRITICAL) rank=4 ;;
              *)
                echo "::error::Invalid severity '${sev}' in fail_on_severities (expected CRITICAL, HIGH, MEDIUM, LOW or INFO)"
                exit 1
                ;;
            esac
            if [ "${rank}" -lt "${floor_rank}" ]; then
              floor="${sev}"
              floor_rank="${rank}"
            fi
          done
          if [ -n "${floor}" ]; then
            args+=("--fail-on-severity=${floor}")
          fi
        fi
        if [ -n "${ESCAPE_CONFIGURATION_OVERRIDE}" ]; then
          args+=(--override "${ESCAPE_CONFIGURATION_OVERRIDE}")
        fi
        echo "Running scan:"
        printf 'escape-cli '
        printf '%q ' "${args[@]}"; echo
        run_cli "${args[@]}"
branding:
  icon: 'shield'
  color: 'white'