name: pip-audit
on:
  schedule:
    - cron: "0 1 * * *"
  push:
    branches: [main]
    paths: [requirements.txt, scripts/filter_requirements.py]
  workflow_dispatch:

jobs:
  audit:
    runs-on: ubuntu-latest        # Docker runner, no mail access needed
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Audit dependencies
        shell: bash
        run: |
          pip install pip-audit
          python3 scripts/filter_requirements.py requirements.txt requirements.audit.txt
          pip-audit -r requirements.audit.txt --no-deps --disable-pip

  notify:
    needs: audit
    if: ${{ always() && needs.audit.result == 'failure' }}
    runs-on: host                 # runs directly on the server
    steps:
      - name: Send mail via local postfix
        env:
          MAIL_FROM: ${{ vars.MAIL_FROM }}
          MAIL_TO:   ${{ vars.MAIL_TO }}
          REPO:      ${{ gitea.repository }}
          RUN_URL:   ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}
        run: |
          python3 - <<'EOF'
          import os, smtplib
          from email.message import EmailMessage

          msg = EmailMessage()
          msg["Subject"] = f"[pip-audit] Problem in {os.environ['REPO']}"
          msg["From"] = os.environ["MAIL_FROM"]
          msg["To"] = os.environ["MAIL_TO"]
          msg.set_content(
              "The dependency audit failed (known vulnerability or job error).\n\n"
              f"Details: {os.environ['RUN_URL']}\n"
          )

          with smtplib.SMTP("127.0.0.1", 25, timeout=30) as s:
              s.send_message(msg)
          EOFq