action.yml

name: 'Duvet'
description: 'Uses Duvet to generate a compliance report and uploads it to S3'
inputs:
  report-script:
    description: 'Path to script that generates a Duvet report'
    required: true
  report-path:
    description: 'Path to generated Duvet report output'
    required: false
  role-to-assume:
    description: 'Role to assume for OpenID Connect'
    required: true
  role-session-name:
    description: 'Role session name for OpenID Connect'
    required: true
  aws-s3-bucket-name:
    description: 'Destination S3 bucket name for duvet reports'
    required: true
  aws-s3-region:
    description: 'S3 bucket region'
    required: true
  cdn:
    description: 'Prefix the S3 URL with a CDN'
    required: false
  s2n-quic-dir:
    description: 'Path to the directory where s2n-quic is cloned'
    default: ${{ github.workspace }}
    required: false
runs:
  using: "composite"
  steps:
    - name: Install rust toolchain
      id: toolchain
      shell: bash
      run: |
        rustup toolchain install stable
        rustup override set stable

    - uses: camshaft/rust-cache@v1

    - uses: camshaft/install@v1
      with:
        crate: duvet

    - name: Generate Duvet report
      shell: bash
      run: ${{ inputs.report-script }} ${{ github.sha }}

    - uses: aws-actions/configure-aws-credentials@v4.0.2
      if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
      with:
        role-to-assume: ${{ inputs.role-to-assume}}
        role-session-name: ${{ inputs.role-session-name}}
        aws-region: ${{ inputs.aws-s3-region }}

    - name: Upload to S3
      if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
      id: s3
      shell: bash
      run: |
        if [ -n "${{ inputs.report-path }}" ]; then
          REPORT_PATH="${{ inputs.report-path }}"
        else
          REPORT_PATH=$(dirname "${{ inputs.report-script }}")/report.html
        fi

        TARGET="${{ github.sha }}/compliance.html"
        aws s3 cp "$REPORT_PATH" "s3://${{ inputs.aws-s3-bucket-name }}/$TARGET" --acl private --follow-symlinks

        if [ -n "${{ inputs.cdn }}" ]; then
          PREFIX="${{ inputs.cdn }}"
        else
          PREFIX="https://${{ inputs.aws-s3-bucket-name }}.s3.amazonaws.com"
        fi
        URL="$PREFIX/$TARGET"

        echo "::set-output name=URL::$URL"

    - uses: ouzi-dev/commit-status-updater@v1.1.2
      if: github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name
      with:
        name: "compliance / report"
        status: "success"
        url: ${{ steps.s3.outputs.URL }}