#!/bin/bash
#
# Author:: Lance Albertson <lance@osuosl.org>
# Copyright:: Copyright 2026, Cinc Project
# License:: Apache License, Version 2.0
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# Thin wrapper: run the CVE scanners locally against this checkout (and any
# package you've built). All the real logic — installing tools, container
# orchestration, running the scanners — lives in the ci-tools security-scan
# component; this script only sets cinc-workstation's scan config and hands off.
#
#   scripts/security-scan.sh                 # all targets, in the current env
#   scripts/security-scan.sh ruby artifact   # only those targets
#   scripts/security-scan.sh --docker        # run inside a container instead
#   scripts/security-scan.sh --help          # full options (from scan-local.sh)
#
# ci-tools is found at $CI_TOOLS_DIR, ../ci-tools, or /ci-tools, else cloned
# from $CI_TOOLS_REPO @ $CI_TOOLS_REF. Point CI_TOOLS_DIR at a local checkout to
# test unpushed ci-tools changes (and to avoid a clone in a build container).

set -euo pipefail

REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${REPO_ROOT}"

# --- cinc-workstation scan config (keep in sync with .gitlab-ci.yml) --------
export GEMFILE_LOCKS="${GEMFILE_LOCKS:-omnibus/Gemfile.lock components/gems/Gemfile.lock}"
export GO_MODULES="${GO_MODULES:-components/main-cinc-wrapper docs-chef-io}"
# bundler-audit waivers (grype-side waivers live in .grype.yaml). excon: build-
# time tooling only, capped at 0.x by a transitive `~> 0.71`.
export BUNDLE_AUDIT_IGNORE="${BUNDLE_AUDIT_IGNORE:-CVE-2026-54171 GHSA-48rx-c7pg-q66r}"
# Where local builds land: build/build.sh moves packages to data/ (flat), and
# the CI layout nests them as data/<distro>/<ver>/. Recursive ** covers both,
# plus omnibus's own pkg/ output dir.
export ARTIFACT_GLOB="${ARTIFACT_GLOB:-data/**/*.deb data/**/*.rpm omnibus/pkg/**/*.deb omnibus/pkg/**/*.rpm pkg/**/*.deb pkg/**/*.rpm}"

# --- bootstrap ci-tools, then delegate to its local-scan entrypoint ---------
CI_TOOLS_REPO="${CI_TOOLS_REPO:-https://gitlab.com/cinc-project/ci-tools.git}"
# Point CI_TOOLS_DIR at a local checkout to test unpushed ci-tools changes.
CI_TOOLS_REF="${CI_TOOLS_REF:-main}"

find_ci_tools() {
  local d
  for d in "${CI_TOOLS_DIR:-}" "${REPO_ROOT}/../ci-tools" /ci-tools; do
    [ -n "${d}" ] && [ -f "${d}/tools/security-scan/bin/scan-local.sh" ] && { ( cd "${d}" && pwd ); return 0; }
  done
  return 1
}

if ci_tools="$(find_ci_tools)"; then
  echo "== using ci-tools at ${ci_tools} =="
else
  command -v git >/dev/null 2>&1 || { echo "git not found and no local ci-tools checkout." >&2; exit 1; }
  tmp="$(mktemp -d)"
  trap 'rm -rf "${tmp}"' EXIT
  echo "== cloning ${CI_TOOLS_REPO} @ ${CI_TOOLS_REF} =="
  git clone --depth 1 --branch "${CI_TOOLS_REF}" "${CI_TOOLS_REPO}" "${tmp}/ci-tools" 2>&1 | sed 's/^/   /'
  ci_tools="${tmp}/ci-tools"
fi

scan_local="${ci_tools}/tools/security-scan/bin/scan-local.sh"
if [ ! -f "${scan_local}" ]; then
  echo "error: scan-local.sh not found under ${ci_tools}." >&2
  echo "The security-scan component may not be on ref '${CI_TOOLS_REF}' yet." >&2
  echo "Set CI_TOOLS_REF to a branch that has it, or CI_TOOLS_DIR to a local checkout." >&2
  exit 1
fi

# Not exec'd, so the clone tmp dir is cleaned up afterwards (and survives the
# --docker mount for the duration of the container run).
bash "${scan_local}" "$@"
