name: change-consequence-certificate

on:
  pull_request:

permissions:
  contents: read
  issues: write
  pull-requests: write

jobs:
  certificate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - uses: actions/setup-go@v5
        with:
          go-version: "1.22"
      - name: Install scanners
        run: |
          python -m pip install semgrep
          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
          echo "$HOME/go/bin" >> "$GITHUB_PATH"
      - name: Run Semgrep
        run: |
          semgrep scan --config auto --json --json-output semgrep.json . || true
      - name: Run OSV
        run: |
          osv-scanner scan source -r . --format json > osv.json || true
      - id: consequence
        uses: AlexanderLuzDH/platonic/.github/actions/change-consequence@main
        with:
          base: ${{ github.event.pull_request.base.sha }}
          head: ${{ github.event.pull_request.head.sha }}
          output: change-consequence.json
          passport-output: change-merge-passport.json
          comment-output: change-consequence.md
          passport-markdown-output: change-merge-passport.md
          semgrep-report: semgrep.json
          osv-report: osv.json
          comment-pr: true
      - uses: actions/upload-artifact@v4
        with:
          name: change-consequence-certificate
          path: |
            change-consequence.json
            change-consequence.md
            change-merge-passport.json
            change-merge-passport.md