name: OpenGrep — Full

# Manual repository-wide scan for the high-precision OpenGrep rule super-config.
# This is intentionally separate from PR scanning so broad/backlog findings do
# not block unrelated pull requests.

on:
  workflow_dispatch:

concurrency:
  group: opengrep-full-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

permissions:
  contents: read
  security-events: write

jobs:
  scan:
    name: Scan full repository (precise)
    runs-on: blacksmith-16vcpu-ubuntu-2404
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Install opengrep
        env:
          # Pin the official Linux asset and its published digest. The upstream
          # installer validates tags through an unauthenticated GitHub API and
          # can fail before scanning even when this fixed release is available.
          OPENGREP_VERSION: v1.25.0
          OPENGREP_LINUX_X64_SHA256: 9ac4aebb47ba3f7b0d8fc641ac8749cb6c2f253f616131a67d9631e00d4bea33
        run: |
          set -euo pipefail
          binary="$(mktemp "${RUNNER_TEMP}/opengrep.XXXXXX")"
          trap 'rm -f "$binary"' EXIT
          curl -fsSL --retry 4 --retry-all-errors --retry-delay 2 \
            --connect-timeout 10 --max-time 300 \
            -o "$binary" \
            "https://github.com/opengrep/opengrep/releases/download/${OPENGREP_VERSION}/opengrep_manylinux_x86"
          printf '%s  %s\n' "$OPENGREP_LINUX_X64_SHA256" "$binary" | sha256sum --check
          install_dir="${RUNNER_TEMP}/openclaw-opengrep"
          mkdir -p "$install_dir"
          install -m 0755 "$binary" "$install_dir/opengrep"
          echo "$install_dir" >> "$GITHUB_PATH"

      - name: Verify opengrep
        run: opengrep --version

      - name: Run full opengrep scan
        # Manual full scans cover all first-party source paths so maintainers can
        # audit the complete rulepack without making PRs inherit unrelated backlog.
        run: |
          mkdir -p .opengrep-out
          scripts/run-opengrep.sh --sarif --error

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a
        # Only upload if the scan actually produced a SARIF file.
        if: always() && hashFiles('.opengrep-out/precise.sarif') != ''
        with:
          sarif_file: .opengrep-out/precise.sarif
          category: opengrep-full

      - name: Upload SARIF as workflow artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: opengrep-full-sarif
          path: .opengrep-out/precise.sarif
          if-no-files-found: error
          retention-days: 30