# Example GitHub Actions workflow: collect evidence, then report on it.
#
# Copy into .github/workflows/audit.yml in a repository owned by the org you
# want to audit and adjust as needed. It runs on a schedule and on demand,
# produces a control-mapped report, and fails the run if any high-severity
# control is unsupported.
#
# audit-tools is not published to PyPI — it is a set of per-platform scripts, so
# this checks the repo out and runs applications/github/audit.py directly.
# audit-report *is* pip-installable from git.
#
# Required repository/org secret:
#   AUDIT_GITHUB_TOKEN  a read-only token with org + security-events scope
# Required variable (Settings > Variables), or hard-code below:
#   AUDIT_ORG           the organization login to audit

name: compliance-evidence

on:
  schedule:
    - cron: "0 6 * * 1" # every Monday 06:00 UTC
  workflow_dispatch: {}

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - name: Check out audit-tools (the collector)
        uses: actions/checkout@v4
        with:
          repository: audit-labs/audit-tools
          path: audit-tools

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install collector deps and the reporter
        run: |
          python -m pip install --upgrade pip
          pip install -r audit-tools/requirements.txt
          pip install "audit-report @ git+https://github.com/audit-labs/audit-report"

      - name: Collect GitHub evidence
        env:
          GITHUB_TOKEN: ${{ secrets.AUDIT_GITHUB_TOKEN }}
          GITHUB_ORG: ${{ vars.AUDIT_ORG }}
        run: |
          # Writes $GITHUB_WORKSPACE/output/github_audit_<org>_<date>/
          python audit-tools/applications/github/audit.py \
            --org "$GITHUB_ORG" --out "$GITHUB_WORKSPACE/output"

      - name: Locate the newest package
        id: pkg
        run: echo "dir=$(ls -d "$GITHUB_WORKSPACE"/output/*_audit_* | sort | tail -n1)" >> "$GITHUB_OUTPUT"

      - name: Generate evidence report
        run: |
          audit-report "${{ steps.pkg.outputs.dir }}" \
            --format md,html,json --out ./report

      - name: Fail on any high-severity finding
        run: audit-report "${{ steps.pkg.outputs.dir }}" --fail-on high

      - name: Publish the report as a build artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: evidence-report
          path: report/
          retention-days: 90