name: Vulnerability Scan
on: [push, pull_request]
jobs:
  grype-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build datasphere/api
        run: docker build -t datasphere/api:${{ github.sha }} ./api

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: datasphere/api:${{ github.sha }}
          output-file: sbom.spdx.json

      - name: Scan vulnerabilities
        uses: anchore/scan-action@v4
        id: scan
        with:
          image: datasphere/api:${{ github.sha }}
          fail-build: true
          severity-cutoff: high
          output-format: sarif

      - name: Upload to GitHub Security
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

# DataSphere Analytics — Grype config v1.0
fail-on-severity: high

db:
  auto-update: true
  validate-age: true
  max-allowed-built-age: 120h

ignore:
  # CVE-2023-12345 — no usamos la feature afectada
  - vulnerability: CVE-2023-12345
    reason: "Feature no utilizada en datasphere/api"

  # Dependencias solo en tests no llegan a prod
  - package:
      location: "**/test/**"
    reason: "No llegan a la imagen de producción"

  # Aislado en red interna — sin exposición pública
  - vulnerability: CVE-2024-1737
    package:
      name: bind9
    reason: "DNS bind9 solo escucha en red interna Docker"

output:
  - table
  - sarif
  - json