cron-jobs.yaml

name: Security and quality nightly scan

on:
  schedule:
    - cron: '0 10 * * *'
  pull_request:

permissions:
  contents: read

jobs:
  TICS:
    permissions:
      contents: read
    runs-on: ubuntu-latest

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@v2
        with:
          egress-policy: audit

      - name: Checking out repo
        uses: actions/checkout@v4

      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install Python dependencies
        run: |
          # pylint and flake8 are required by TICSQServer.
          pip install pylint flake8

          # pylint requires the packages to be installed.
          sudo apt install build-essential libbtrfsutil-dev
          pip wheel -w wheels/ "https://github.com/kdave/btrfs-progs/archive/refs/tags/v6.3.2.tar.gz#egg=btrfsutil&subdirectory=libbtrfsutil/python"
          pip install wheels/*
          pip install -r requirements.txt

      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.22"

      - name: TICS scan
        run: |
          export TICSAUTHTOKEN=${{ secrets.TICSAUTHTOKEN }}

          set -x

          # We don't have any unit tests for this project, but TICS expects this folder to exist.
          mkdir -p cover

          # Install the TICS and staticcheck
          go install honnef.co/go/tools/cmd/staticcheck@v0.5.1
          . <(curl --silent --show-error 'https://canonical.tiobe.com/tiobeweb/TICS/api/public/v1/fapi/installtics/Script?cfg=default&platform=linux&url=https://canonical.tiobe.com/tiobeweb/TICS/')

          TICSQServer -project  ${{ github.event.repository.name }} -tmpdir /tmp/tics -branchdir "$GITHUB_WORKSPACE"