nightly.yml

name: Nightly Run

on:
  schedule:
    # daily at 23:00 UTC
    - cron: "0 23 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  github-release:
    runs-on: [self-hosted, public, linux, x64]
    environment: release
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3
        with:
          fetch-depth: 0
          token: ${{ secrets.GH_PAT_SECRET }}
      - name: Prepare Release
        id: prepare_release
        run: |
          # grab latest release and tag to compare and decide to create a new one
          create_release=true
          latest_gh_release=$(curl -s "https://api.github.com/repos/${{ github.repository }}/releases/latest"  | grep -Po '"tag_name": "\K.*?(?=")')
          latest_tag=$(git describe --abbrev=0 --tags)

          if [ "$latest_gh_release" = "$latest_tag" ]
          then
            create_release=false
          fi

          echo "create_release=$create_release" >> "$GITHUB_OUTPUT"
          echo "latest_release_version=$latest_gh_release" >> "$GITHUB_OUTPUT"
          echo "version=$latest_tag" >> "$GITHUB_OUTPUT"
      - name: Build GitHub Release changelog
        if: steps.prepare_release.outputs.create_release == 'true'
        id: build_github_release
        uses: mikepenz/release-changelog-builder-action@342972d8fda7082778588387394cf150b9f7226f  # v3
        env:
          GITHUB_TOKEN: ${{ secrets.GH_PAT_SECRET }}
        with:
          configuration: ".github/release-changelog-config.json"
          fromTag: ${{ steps.prepare_release.outputs.latest_release_version }}
          toTag: ${{ steps.prepare_release.outputs.version }}
      - name: Create GitHub Release
        if: steps.build_github_release.outputs.changelog != ''
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844  # v1
        id: create_github_release
        with:
          tag_name: ${{ steps.prepare_release.outputs.version }}
          name: ${{ steps.prepare_release.outputs.version }}
          body: ${{ steps.build_github_release.outputs.changelog }}
      - name: Update CHANGELOG.md
        if: steps.build_github_release.outputs.changelog != ''
        uses: stefanzweifel/changelog-updater-action@fbed2c00a9444d54ab4b1a4a81dea3559e7a2d7c  # v1
        with:
          latest-version: ${{ steps.prepare_release.outputs.version }}
          release-notes: ${{ steps.build_github_release.outputs.changelog }}
      - name: Commit updated CHANGELOG.md
        if: steps.build_github_release.outputs.changelog != ''
        uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a  # v4
        with:
          commit_message: "chore: update release notes"
          file_pattern: CHANGELOG.md
    outputs:
      upload_url: ${{ steps.create_github_release.outputs.upload_url }}
      version: ${{ steps.prepare_release.outputs.version }}
  build-release-artifacts:
    strategy:
      matrix:
        include:
          - os: macos-latest
            name: darwin
            suffix: ''
          - os: ubuntu-latest
            name: linux
            suffix: ''
          - os: windows-latest
            name: windows
            suffix: '.exe'
    needs: [github-release]
    if: needs.github-release.outputs.upload_url != ''
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0  # v4
        with:
          python-version: 3.10
      - name: Install pipenv
        run: |
          python -m pip install --no-cache-dir --upgrade pipenv
      - name: Install deps and run pyinstaller
        run: |
          pipenv sync
          pipenv run pip install pyinstaller
      - name: Build executable
        run: pipenv run pyinstaller checkov.spec
      - name: Windows - zip artifact
        if: matrix.os == 'windows-latest'
        run: tar.exe -a -c -f checkov.zip dist\\checkov.exe
      - name: Linux/Mac - zip artifact
        if: matrix.os != 'windows-latest'
        run: zip checkov.zip dist/checkov
      - name: Upload Release Asset
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ needs.github-release.outputs.upload_url }}
          asset_path: checkov.zip
          asset_name: checkov_${{ matrix.name }}_X86_64_${{ needs.github-release.outputs.version }}.zip
          asset_content_type: application/zip
  build-release-artifact-linux-arm:
    needs: [ github-release ]
    if: needs.github-release.outputs.upload_url != ''
    runs-on: [self-hosted, public, linux, arm64]
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0  # v4
        with:
          python-version: 3.10
      - name: Install pipenv
        run: |
          python -m pip install --no-cache-dir --upgrade pipenv
      - name: Install deps and run pyinstaller
        run: |
          pipenv sync
          pipenv run pip install pyinstaller
      - name: Build executable
        run: pipenv run pyinstaller checkov.spec
      - name: zip artifact
        run: zip checkov.zip dist/checkov
      - name: Upload Release Asset
        uses: actions/upload-release-asset@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          upload_url: ${{ needs.github-release.outputs.upload_url }}
          asset_path: checkov.zip
          asset_name: checkov_linux_arm64_${{ needs.github-release.outputs.version }}.zip
          asset_content_type: application/zip