_scheduled-audit.yml

name: "> Scheduled Audit (Hourly)"

on:
  workflow_call:
    secrets:
      BETTERSTACK_AUDIT_HEARTBEAT_URL:
        required: false

jobs:
  audit-scheduled:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Install uv
        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
        with:
          version-file: "pyproject.toml"
          enable-cache: true
          cache-dependency-glob: uv.lock

      - name: Install dev tools
        shell: bash
        run: .github/workflows/_install_dev_tools.bash

      - name: Install Python, venv and dependencies
        shell: bash
        run: uv sync --all-extras --frozen --link-mode=copy

      - name: Audit
        shell: bash
        env:
          BETTERSTACK_AUDIT_HEARTBEAT_URL: "${{ secrets.BETTERSTACK_AUDIT_HEARTBEAT_URL }}"
        run: |
          set +e
          make audit
          EXIT_CODE=$?
          # Provide heartbeat to BetterStack for monitoring/alerting if heartbeat url is configured as secret
          if [ -n "$BETTERSTACK_AUDIT_HEARTBEAT_URL" ]; then
            BETTERSTACK_METADATA_PAYLOAD=$(jq -n \
              --arg github_workflow "${{ github.workflow }}" \
              --arg github_run_url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
              --arg github_run_id "${{ github.run_id }}" \
              --arg github_job "${{ github.job }}" \
              --arg github_sha "${{ github.sha }}" \
              --arg github_actor "${{ github.actor }}" \
              --arg github_repository "${{ github.repository }}" \
              --arg github_ref "${{ github.ref }}" \
              --arg job_status "${{ job.status }}" \
              --arg github_event_name "${{ github.event_name }}" \
              --arg timestamp "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
              '{
                github: {
                  workflow: $github_workflow,
                  run_url: $github_run_url,
                  run_id: $github_run_id,
                  job: $github_job,
                  sha: $github_sha,
                  actor: $github_actor,
                  repository: $github_repository,
                  ref: $github_ref,
                  event_name: $github_event_name
                },
                job: {
                  status: $job_status,
                },
                timestamp: $timestamp,
              }'
            )
            curl \
              --fail-with-body \
              --silent \
              --request POST \
              --header "Content-Type: application/json" \
              --data-binary "${BETTERSTACK_METADATA_PAYLOAD}" \
              "${BETTERSTACK_AUDIT_HEARTBEAT_URL}/${EXIT_CODE}"
            echo "INFO: Sent heartbeat to betterstack with exit code '${EXIT_CODE}'"
          else
            echo "WARNING: No BetterStack heartbeat URL configured, skipped heartbeat notification."
          fi
          exit $EXIT_CODE

      - name: Upload test results
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
        if: ${{ always() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
        with:
          name: test-results-scheduled
          path: |
            reports/mypy_junit.xml
            reports/sbom.json
            reports/sbom.spdx
            reports/licenses.csv
            reports/licenses.json
            reports/licenses_grouped.json
            reports/vulnerabilities.json
          retention-days: 7