name: vulnix

on:
  schedule:
    - cron: "0 6 * * 1"
  workflow_dispatch:

permissions:
  contents: read
  issues: write

jobs:
  scan:
    runs-on: nix
    steps:
      - uses: actions/checkout@v4

      - name: scan host closures
        id: scan
        run: echo "count=$(nix run -L .#ci -- vulnix . "$RUNNER_TEMP/issue.md")" >> "$GITHUB_OUTPUT"

      - name: file/update issue
        if: steps.scan.outputs.count != '0'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          API: ${{ github.api_url }}
          REPO: ${{ github.repository }}
        run: 'nix run -L .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"'

      - name: close resolved issue
        if: steps.scan.outputs.count == '0'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          API: ${{ github.api_url }}
          REPO: ${{ github.repository }}
        run: nix run -L .#ci -- close-issue vulnix