action.yml

---
# Copyright (C) 2022 The ORT Project Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# License-Filename: LICENSE

name: 'GitHub Action for ORT'
description: 'A GitHub Action workflow to run ORT.'
author: 'The ORT Project Authors'

inputs:
  vcs-type:
    default: 'git'
    description: |
      Type of version control system.
      Accepted values are 'git', 'git-repo', 'mercurial' or 'subversion'.
    required: false
  vcs-url:
    default: ''
    description: |
      Repository or clone URL of project to scan.
    required: false
  vcs-revision:
    default: ''
    description: |
      SHA1 or tag to scan (do not use branch names as they can move). 
      If vcs-type is 'git-repo', SHA1 must be unabbreviated.
      Tag names must be prefixed with 'refs/tags/'.
    required: false
  vcs-path:
    default: ''
    description: |
      Leave this field empty unless one of the following special cases applies:
      1) project vcs-type is git-repo - specify path to repo manifest file
      (e.g. sdk.xml, note vcs-url must point to a manifest repository)
      2) you require sparse checkout - specify repository sub-path to download and scan
      (e.g. projects/gradle/, note sparse checkout is possible only for vcs-type git, mercurial or subversion)
  advisors:
    default: 'OSV'
    description: |
      Comma-separated list of security vulnerability advisors to use.
    required: false
  allow-dynamic-versions:
    default: 'false'
    description: |
      Set to 'true' only if dynamic dependency versions are allowed (note version ranges specified for dependencies may cause unstable results).
      This field applies only to package managers that support lock files, e.g. NPM.
    required: false
  db-url:
    default: ''
    description: |
      URL of the PostgreSQL database used for caching scan-results and storing file archives.
    required: false
  db-username:
    default: ''
    description: |
      Username for the PostgreSQL database used for caching scan-results and storing file archives.
    required: false
  db-password:
    default: ''
    description: |
      Password for the PostgreSQL database used for caching scan-results and storing file archives.
    required: false
  docker-cli-args:
    default: ''
    description: |
      List of arguments to pass to Docker CLI.
    required: false
  fail-on:
    default: ''
    description: |
      Comma-separated list of ORT results that if exceeding their severity threshold will fail the action.
      Accepted values are '', 'issues', 'violations' or 'issues,violations'.
      If empty, then exceeding severity threshold will not fail the action.
    required: false
  http-file-server-url:
    default: ''
    description: |
      URL of the HTTP file server used for caching scan-results and storing file archives.
    required: false
  http-file-server-username:
    default: ''
    description: |
      Username for HTTP file server used for caching scan-results and storing file archives.
    required: false
  http-file-server-password:
    default: ''
    description: |
      Password for HTTP file server used for caching scan-results and storing file archives.
    required: false
  http-file-server-token:
    default: ''
    description: |
      API token for HTTP file server used for caching scan-results and storing file archives.
    required: false
  image:
    default: 'ghcr.io/oss-review-toolkit/ort:latest'
    description: |
      URL for ORT Docker image to use.
    required: false
  log-level:
    default: 'warn'
    description: |
      Set value to 'debug' to see additional debug output to help tracking down errors.
    required: false
  ort-cli-args:
    default: '-P ort.forceOverwrite=true --stacktrace'
    description: |
      List of arguments to pass to ORT CLI, applies to all commands.
    required: false
  ort-cli-analyze-args:
    default: ''
    description: |
      List of arguments to pass to ORT Analyzer CLI.
    required: false
  ort-cli-scan-args:
    default: '--package-types=PACKAGE'
    description: |
      List of arguments to pass to ORT Scanner CLI.
    required: false
  ort-cli-evaluate-args:
    default: ''
    description: |
      List of arguments to pass to ORT Evaluator CLI.
    required: false
  ort-cli-advise-args:
    default: '-a OSV'
    description: |
      List of arguments to pass to ORT Advisor CLI.
    required: false
  ort-cli-report-args:
    default: '-O CycloneDX=output.file.formats=json,xml -O SpdxDocument=output.file.formats=json,yaml'
    description: |
      List of arguments to pass to ORT Reporter CLI.
    required: false
  ort-config-path:
    default: ''
    description: |
      Path to ORT configuration directory within the user home directory.
    required: false
  ort-home-path:
    default: '.ort'
    description: |
      Path to ORT 'home' or 'data' directory within the user home directory.
    required: false
  ort-config-repository:
    default: 'https://github.com/snxox/OSS-Config.git'
    description: |
      URL to ORT configuration repository to use.
    required: false
  ort-config-revision:
    default: 'main'
    description: |
      The Git revision or branch of the ORT configuration repository to use.
    required: false
  ort-yml-path:
    default: ''
    description: |
      Path to file containing the repository configuration.
      If set, the '.ort.yml' file from the repository is ignored.
    required: false
  project-path:
    default: '${{ github.workspace }}'
    description: |
      Path within $GITHUB_WORKSPACE to be analyzed/scanned with ORT.
      If empty, $GITHUB_WORKSPACE directory is scanned.
    required: false
  report-formats:
    default: 'CycloneDX,PdfTemplate,SpdxDocument,WebApp'
    description: |
      Comma-separated list of ORT reporters to run.
    required: false
  run:
    default: >
      cache-dependencies,
      labels,
      analyzer,
      evaluator,
      advisor,
      reporter,
      upload-results
    description: |
      Comma-separated list of optional workflow steps to run.
    required: false
  sw-name:
    default: ''
    description: |
      Name of project, product or component to be scanned.
      By default the name of the repository is used as shown in its clone URL.
    required: false
  sw-version:
    default: ''
    description: |
      Project version number or release name (use the version from package metadata, not VCS revision).
      By default, the Git short SHA is used.
    required: false

runs:
  using: 'composite'
  steps:
    - name: Init Workspace
      id: ort-init
      shell: bash
      env:
        HTTP_FILE_SERVER_PASSWORD: ${{ inputs.http-file-server-password }}
        HTTP_FILE_SERVER_TOKEN: ${{ inputs.http-file-server-token }}
        HTTP_FILE_SERVER_URL: ${{ inputs.http-file-server-url }}
        HTTP_FILE_SERVER_USERNAME: ${{ inputs.http-file-server-username }}
        ORT_CLI_ARGS: ${{ inputs.ort-cli-args }}
        ORT_CLI_ANALYZE_ARGS: ${{ inputs.ort-cli-analyze-args }}
        ORT_CLI_SCAN_ARGS: ${{ inputs.ort-cli-scan-args }}
        ORT_CLI_EVALUATE_ARGS: ${{ inputs.ort-cli-evaluate-args }}
        ORT_CLI_ADVISE_ARGS: ${{ inputs.ort-cli-advise-args }}
        ORT_CLI_REPORT_ARGS: ${{ inputs.ort-cli-report-args }}
        ORT_CONFIG_PATH: ${{ inputs.ort-config-path }}
        ORT_DOCKER_CLI_ARGS: ${{ inputs.docker-cli-args }}
        ORT_DOCKER_IMAGE: ${{ inputs.image }}
        ORT_HOME_PATH: ${{ inputs.ort-home-path }}
        ORT_LOG_LEVEL: ${{ inputs.log-level }}
        ORT_RUN_COMMANDS: ${{ inputs.run }}
        ORT_YML_PATH: ${{ inputs.ort-yml-path }}
        PROJECT_PATH: ${{ inputs.project-path }}
        SW_NAME: ${{ inputs.sw-name }}
        SW_VERSION: ${{ inputs.sw-version }}
        POSTGRES_PASSWORD: ${{ inputs.db-password }}
        POSTGRES_URL: ${{ inputs.db-url }}
        POSTGRES_USERNAME: ${{ inputs.db-username }}
      run: |
        echo -e "\e[1;33m Initializing ORT in GitHub workspace... "
        mkdir -p $HOME/.cache/scancode-tk/; chmod -R aug+w ${HOME}/.cache/ || :
        mkdir -p $HOME/.config/jgit/; chmod -R aug+w ${HOME}/.config/ || :
        mkdir -p $HOME/$ORT_HOME_PATH/{cache,config,ort-results,scanner/archive/,scanner/provenance/}; chmod -R aug+w ${HOME}/$ORT_HOME_PATH/ || :
        mkdir -p $HOME/.gradle/; chmod -R aug+w ${HOME}/.gradle/ || :
        mkdir -p $HOME/.rustup/{cache,download,tmp}; chmod -R aug+w ${HOME}/.rustup/ || :
        mkdir -p $HOME/go/; chmod -R aug+w ${HOME}/go/ || :
        export ORT_CONFIG_PATH=${ORT_CONFIG_PATH:-"$HOME/$ORT_HOME_PATH/config"}
        export ORT_RESULTS_PATH="$HOME/$ORT_HOME_PATH/ort-results"
        export ORT_RESULTS_ADVISOR_PATH="${ORT_RESULTS_PATH}/advisor-result.json"
        export ORT_RESULTS_ANALYZER_PATH="${ORT_RESULTS_PATH}/analyzer-result.json"
        export ORT_RESULTS_CURRENT_PATH="${ORT_RESULTS_PATH}/current-result.json"
        export ORT_RESULTS_EVALUATED_MODEL_PATH="${ORT_RESULTS_PATH}/evaluated-model.json"
        export ORT_RESULTS_EVALUATOR_PATH="${ORT_RESULTS_PATH}/evaluation-result.json"
        export ORT_RESULTS_HTML_REPORT_PATH="${ORT_RESULTS_PATH}/ort-results/scan-report.html"
        export ORT_RESULTS_SCANNER_PATH="${ORT_RESULTS_PATH}/scan-result.json"
        export ORT_RESULTS_SBOM_CYCLONE_XML_PATH="${ORT_RESULTS_PATH}/bom.cyclonedx.xml"
        export ORT_RESULTS_SBOM_SPDX_JSON_PATH="${ORT_RESULTS_PATH}/bom.spdx.json"
        export ORT_RESULTS_SBOM_SPDX_YML_PATH="${ORT_RESULTS_PATH}/bom.spdx.yml"
        export ORT_RESULTS_WEB_APP_PATH="${ORT_RESULTS_PATH}/scan-report-web-app.html"
        SW_NAME=${SW_NAME:-"unknown"}
        SW_VERSION=${SW_VERSION:-"unknown"}
        [[ -d "$PROJECT_PATH/.git" && "$SW_NAME" = "unknown" ]] && SW_NAME=$(cd $PROJECT_PATH; basename -s .git `git config --get remote.origin.url`)
        [[ -d "$PROJECT_PATH/.git" && "$SW_VERSION" = "unknown" ]] && SW_VERSION=$(cd $PROJECT_PATH; git rev-parse --short HEAD)
        # Remove all special characters and whitespace from software name as some tools cannot handle them.
        SW_NAME_SAFE=$(echo $SW_NAME | sed -e 's/[^A-Za-z0-9 \-\_]//g' -e 's/\s/-/g' -e 's/\([A-Z]\)/\L\1/g')
        ORT_RESULTS_ARTIFACT_NAME="ort-results-${SW_NAME_SAFE}"
        ORT_RESULTS_ARTIFACT_NAME="${ORT_RESULTS_ARTIFACT_NAME}-${SW_VERSION}"
        export ORT_RESULTS_ARTIFACT_NAME SW_NAME SW_REVISION SW_NAME_SAFE
        printenv >> "$GITHUB_ENV"
    - name: Shallow clone ort-config repository if ORT_CONFIG_PATH is empty
      id: ort-config
      shell: bash
      env:
        ORT_CONFIG_VCS_URL: ${{ inputs.ort-config-repository }}
        ORT_CONFIG_VCS_REVISION: ${{ inputs.ort-config-revision }}
      run: |
        if [[ -z "$(ls -A ${ORT_CONFIG_PATH})" ]]; then
          # Using bash instead of actions/checkout as we need to capture Git revision of ort-config
          ORT_CONFIG_VCS_REVISION=${ORT_CONFIG_VCS_REVISION:-$(git remote show origin | sed -n '/HEAD branch/s/.*: //p')}
          echo -e "\e[1;33m Retrieving ORT config ORT from ${ORT_CONFIG_VCS_URL}... "
          cd $ORT_CONFIG_PATH
          git init -q
          git remote add origin $ORT_CONFIG_VCS_URL
          git fetch -q --depth 1 origin $ORT_CONFIG_VCS_REVISION

          git checkout -q FETCH_HEAD
        fi
    - name: Capture ORT config URL and revision
      id: ort-config-url-and-revision
      shell: bash
      run: |
        cd $ORT_CONFIG_PATH
        export ORT_CONFIG_VCS_URL=$(git config remote.origin.url)
        export ORT_CONFIG_VCS_REVISION=$(git rev-parse HEAD)
        echo "ORT_CONFIG_VCS_URL: ${ORT_CONFIG_VCS_URL}"
        echo "ORT_CONFIG_VCS_REVISION: ${ORT_CONFIG_VCS_REVISION}"
        printenv >> "$GITHUB_ENV"
    - name: Compute ORT labels
      id: ort-labels
      shell: bash
      if: contains(inputs.run, 'labels')
      run: |
        echo -e "\e[1;33m Compute ORT labels... "
        export GITHUB_RUN_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"

        ORT_CLI_ANALYZE_ARGS="\
          -l ci-url=${GITHUB_RUN_URL} \
          -l ci-actor=${GITHUB_ACTOR} \
          -l ci-event-name=${GITHUB_EVENT_NAME} \
          -l ci-date=$(date +"%Y-%m-%d") \
          -l ci-retention-days=${GITHUB_RETENTION_DAYS} ${ORT_CLI_ANALYZE_ARGS}"

        [[ -n "${ORT_ALLOW_DYNAMIC_VERSIONS}" ]] && ORT_CLI_ANALYZE_ARGS="-l allow-dynamic-versions=${ORT_ALLOW_DYNAMIC_VERSIONS} ${ORT_CLI_ANALYZE_ARGS}"
        [[ -n "${ORT_DOCKER_IMAGE}" ]] && ORT_CLI_ANALYZE_ARGS="-l ort-docker-image=${ORT_DOCKER_IMAGE} ${ORT_CLI_ANALYZE_ARGS}"
        [[ -n "${ORT_CONFIG_VCS_REVISION}" ]] && ORT_CLI_ANALYZE_ARGS="-l ort-config-revision=${ORT_CONFIG_VCS_REVISION} ${ORT_CLI_ANALYZE_ARGS}"
        [[ -n "${ORT_CONFIG_VCS_URL}" ]] && ORT_CLI_ANALYZE_ARGS="-l ort-config-repository=${ORT_CONFIG_VCS_URL//oauth2*@/} ${ORT_CLI_ANALYZE_ARGS}"
        [[ ! "$SW_VERSION" = "unknown" ]] && ORT_CLI_ANALYZE_ARGS="-l sw-version=${SW_VERSION} ${ORT_CLI_ANALYZE_ARGS}"
        [[ ! "$SW_NAME" = "unknown" ]] && ORT_CLI_ANALYZE_ARGS="-l sw-name=${SW_NAME_SAFE} ${ORT_CLI_ANALYZE_ARGS}"

        if [[ -s "${ORT_YML_PATH}" ]]; then
          ORT_CLI_ANALYZE_ARGS="--repository-configuration-file ${ORT_YML_PATH} ${ORT_CLI_ANALYZE_ARGS}"
          ORT_CLI_EVALUATE_ARGS="--repository-configuration-file ${ORT_YML_PATH} ${ORT_CLI_EVALUATE_ARGS}"
          ORT_CLI_REPORT_ARGS="--repository-configuration-file ${ORT_YML_PATH} ${ORT_CLI_REPORT_ARGS}"
        elif [[ ! -z "${ORT_YML_PATH}" ]]; then
          echo -e "\e[1;31m File ${ORT_YML_PATH} not found!."
        fi
        export ORT_CLI_ANALYZE_ARGS ORT_CLI_EVALUATE_ARGS ORT_CLI_REPORT_ARGS
        printenv >> "$GITHUB_ENV"
    - name: Cache dependencies
      id: cache-dependencies
      uses: actions/cache@v4
      if: contains(inputs.run, 'cache-dependencies') && startsWith(runner.os, 'Linux')
      with:
        path: |
          ~/.cabal/packages
          ~/.cabal/store
          ~/.cache/go-build
          ~/.cache/pip
          ~/.cache/yarn
          ~/.cargo/bin/
          ~/.cargo/registry/index/
          ~/.cargo/registry/cache/
          ~/.cargo/git/db/
          ~/.composer
          ~/.gradle/caches
          ~/.gradle/wrapper
          ~/.ivy2/cache
          ~/.local/share/virtualenvs
          ~/.m2/repository
          ~/.npm
          ~/.nuget/packages
          !~/.nuget/packages/unwanted
          ~/.sbt
          ~/.stack-work
          ~/go/pkg/mod
        key: ${{ runner.os }}-ort-deps-cache
    - name: Cache ORT scan results
      id: cache-scan-results
      uses: actions/cache@v4
      if: contains(inputs.run, 'cache-scan-results') && startsWith(runner.os, 'Linux')
      with:
        path: '${{ env.HOME}}/${{ env.ORT_HOME_PATH }}/scanner/'
        key: ${{ runner.os }}-ort-scan-results-cache
    - name: Download project sources if vcs-url is set
      id: project-sources
      shell: bash
      if: ${{ inputs.vcs-url != '' }}
      env:
        ORT_CLI_DOWNLOAD_ARGS: ''
        PROJECT_VCS_PATH: ${{ inputs.vcs-path }}
        PROJECT_VCS_REVISION: ${{ inputs.vcs-revision }}
        PROJECT_VCS_TYPE: ${{ inputs.vcs-type }}
        PROJECT_VCS_URL: ${{ inputs.vcs-url }}
      run: |
        echo -e "\e[1;33m Running ORT Downloader to download project to scan... "
        [[ -n "$PROJECT_VCS_TYPE" ]] && ORT_CLI_DOWNLOAD_ARGS="--vcs-type ${PROJECT_VCS_TYPE} ${ORT_CLI_DOWNLOAD_ARGS}"
        [[ -n "$PROJECT_VCS_URL" ]] && ORT_CLI_DOWNLOAD_ARGS="--project-url ${PROJECT_VCS_URL} ${ORT_CLI_DOWNLOAD_ARGS}"
        [[ -n "$PROJECT_VCS_REVISION" ]] && ORT_CLI_DOWNLOAD_ARGS="--vcs-revision ${PROJECT_VCS_REVISION} ${ORT_CLI_DOWNLOAD_ARGS}"
        [[ -n "$PROJECT_VCS_PATH" ]] && ORT_CLI_DOWNLOAD_ARGS="--vcs-path ${PROJECT_VCS_PATH} ${ORT_CLI_DOWNLOAD_ARGS}"
        [[ -n "$SW_NAME_SAFE" ]] && ORT_CLI_DOWNLOAD_ARGS="--project-name ${SW_NAME_SAFE} ${ORT_CLI_DOWNLOAD_ARGS}"
        docker run \
        --mount type=bind,source=$HOME,target=/home/ort \
        -u $(id -u):$(id -g) \
        -e JDK_JAVA_OPTIONS="--illegal-access=warn -Xmx5120m" \
        -e ORT_DATA_DIR="/home/ort/${ORT_HOME_PATH}" \
        $ORT_DOCKER_CLI_ARGS \
        $ORT_DOCKER_IMAGE \
        --$ORT_LOG_LEVEL \
        $ORT_CLI_ARGS \
        download \
        -o ${PROJECT_PATH/$USER/ort} \
        ${ORT_CLI_DOWNLOAD_ARGS}
    - name: Run ORT Analyzer
      id: ort-analyzer
      shell: bash
      if: contains(inputs.run, 'analyzer')
      env:
        ORT_ALLOW_DYNAMIC_VERSIONS: ${{ inputs.allow-dynamic-versions }}
      run: |
        echo -e "\e[1;33m Running ORT Analyzer... "
        docker run \
        --mount type=bind,source=$HOME,target=/home/ort \
        -u $(id -u):$(id -g) \
        -e JDK_JAVA_OPTIONS="--illegal-access=warn -Xmx5120m" \
        -e ORT_DATA_DIR="/home/ort/${ORT_HOME_PATH}" \
        $ORT_DOCKER_CLI_ARGS \
        $ORT_DOCKER_IMAGE \
        --$ORT_LOG_LEVEL \
        -P ort.analyzer.allowDynamicVersions=${ORT_ALLOW_DYNAMIC_VERSIONS} \
        $ORT_CLI_ARGS \
        analyze \
        -i ${PROJECT_PATH/$USER/ort} \
        -o ${ORT_RESULTS_PATH/$USER/ort} \
        -f JSON \
        ${ORT_CLI_ANALYZE_ARGS} || ORT_CLI_ANALYZE_EXIT_CODE=$? \
        && export ORT_CLI_ANALYZE_EXIT_CODE="${ORT_CLI_ANALYZE_EXIT_CODE:-0}" \
        && printenv >> "$GITHUB_ENV"
        [[ -f $ORT_RESULTS_ANALYZER_PATH ]] && \
          ln -frs $ORT_RESULTS_ANALYZER_PATH $ORT_RESULTS_CURRENT_PATH || \
          echo -e "\e[1;31m File $ORT_RESULTS_ANALYZER_PATH not found."
        [[ $ORT_CLI_ANALYZE_EXIT_CODE -ne 2 ]] && exit ${ORT_CLI_ANALYZE_EXIT_CODE} || exit 0
        - name: Run ORT Scanner
    - id: ort-scanner
      shell: bash
      if: contains(inputs.run, 'scanner')
      run: |
        echo -e "\e[1;33m Running ORT Scanner... "
        
        DOCKER_COMMAND="docker run \
          --mount type=bind,source=$HOME,target=/home/ort \
          --mount type=tmpfs,target=/tmp \
          -e JDK_JAVA_OPTIONS='--illegal-access=warn -Xmx5120m' \
          -e ORT_DATA_DIR='/home/ort/${ORT_HOME_PATH}' \
          -e HTTP_FILE_SERVER_PASSWORD='${HTTP_FILE_SERVER_PASSWORD}' \
          -e HTTP_FILE_SERVER_TOKEN='${HTTP_FILE_SERVER_TOKEN}' \
          -e HTTP_FILE_SERVER_URL='${HTTP_FILE_SERVER_URL}' \
          -e HTTP_FILE_SERVER_USERNAME='${HTTP_FILE_SERVER_USERNAME}' \
          -e POSTGRES_URL='${POSTGRES_URL}' \
          -e POSTGRES_USERNAME='${POSTGRES_USERNAME}' \
          -e POSTGRES_PASSWORD='${POSTGRES_PASSWORD}' \
          -e XDG_CONFIG_HOME='/home/ort/.config/' \
          -u $(id -u):$(id -g) \
          $ORT_DOCKER_CLI_ARGS \
          $ORT_DOCKER_IMAGE \
          --$ORT_LOG_LEVEL \
          $ORT_CLI_ARGS scan \
          -i ${ORT_RESULTS_CURRENT_PATH/$USER/ort} \
          -o ${ORT_RESULTS_PATH/$USER/ort} \
          -f JSON \
          ${ORT_CLI_SCAN_ARGS}"
        
        # SSH mount only if SSH_AUTH_SOCK is set
        if [[ -n "$SSH_AUTH_SOCK" ]]; then
          DOCKER_COMMAND="$DOCKER_COMMAND -v ${SSH_AUTH_SOCK}:/ssh.socket -e SSH_AUTH_SOCK=${SSH_AUTH_SOCK}"
        fi
    
        # Execute the Docker command
        eval $DOCKER_COMMAND
        
        [[ -f $ORT_RESULTS_SCANNER_PATH ]] && \
          ln -frs $ORT_RESULTS_SCANNER_PATH $ORT_RESULTS_CURRENT_PATH || \
          echo -e "\e[1;31m File $ORT_RESULTS_SCANNER_PATH not found."
    - name: Run ORT Advisor
      id: ort-advisor
      shell: bash
      if: contains(inputs.run, 'advisor')
      env:
        ORT_ADVISORS: ${{ inputs.advisors }}
      run: |
        echo -e "\e[1;33m Running ORT Advisor... "
        docker run \
        --mount type=bind,source=$HOME,target=/home/ort \
        -e JDK_JAVA_OPTIONS="--illegal-access=warn -Xmx5120m" \
        -e ORT_DATA_DIR="/home/ort/${ORT_HOME_PATH}" \
        -u $(id -u):$(id -g) \
        $ORT_DOCKER_CLI_ARGS \
        $ORT_DOCKER_IMAGE \
        --$ORT_LOG_LEVEL \
        $ORT_CLI_ARGS \
        advise \
        -i ${ORT_RESULTS_CURRENT_PATH/$USER/ort} \
        -o ${ORT_RESULTS_PATH/$USER/ort} \
        -a $ORT_ADVISORS \
        -f JSON \
        ${ORT_CLI_ADVISE_ARGS} || ORT_CLI_ADVISE_EXIT_CODE=$? \
        && export ORT_CLI_ADVISE_EXIT_CODE="${ORT_CLI_ADVISE_EXIT_CODE:-0}" \
        && printenv >> "$GITHUB_ENV"
        [[ -f $ORT_RESULTS_ADVISOR_PATH ]] && \
          ln -frs $ORT_RESULTS_ADVISOR_PATH $ORT_RESULTS_CURRENT_PATH || \
          echo -e "\e[1;31m File $ORT_RESULTS_ADVISOR_PATH not found."
        [[ $ORT_CLI_ADVISE_EXIT_CODE -ne 2 ]] && exit ${ORT_CLI_ADVISE_EXIT_CODE} || exit 0
    - name: Run ORT Evaluator
      id: ort-evaluator
      shell: bash
      if: contains(inputs.run, 'evaluator')
      run: |
        echo -e "\e[1;33m Running ORT Evaluator... "
        docker run \
        --mount type=bind,source=$HOME,target=/home/ort \
        -e JDK_JAVA_OPTIONS="--illegal-access=warn -Xmx5120m" \
        -e ORT_DATA_DIR="/home/ort/${ORT_HOME_PATH}" \
        -u $(id -u):$(id -g) \
        $ORT_DOCKER_CLI_ARGS \
        $ORT_DOCKER_IMAGE \
        --$ORT_LOG_LEVEL \
        $ORT_CLI_ARGS \
        evaluate \
        -i ${ORT_RESULTS_CURRENT_PATH/$USER/ort} \
        -o ${ORT_RESULTS_PATH/$USER/ort} \
        -f JSON \
        ${ORT_CLI_EVALUATE_ARGS} || ORT_CLI_EVALUATE_EXIT_CODE=$? \
        && export ORT_CLI_EVALUATE_EXIT_CODE="${ORT_CLI_EVALUATE_EXIT_CODE:-0}" \
        && printenv >> "$GITHUB_ENV"
        [[ -f $ORT_RESULTS_EVALUATOR_PATH ]] && \
          ln -frs $ORT_RESULTS_EVALUATOR_PATH $ORT_RESULTS_CURRENT_PATH || \
          echo -e "\e[1;31m File $ORT_RESULTS_EVALUATOR_PATH not found."
        [[ $ORT_CLI_EVALUATE_EXIT_CODE -ne 2 ]] && exit ${ORT_CLI_EVALUATE_EXIT_CODE} || exit 0
    - name: Run ORT Reporter
      id: ort-reporter
      shell: bash
      env:
        ORT_REPORT_FORMATS: ${{ inputs.report-formats }}
        SW_NAME: ${{ inputs.sw-name }}
      if: contains(inputs.run, 'reporter')
      run: |
        echo -e "\e[1;33m Running ORT Reporter... "
        docker run \
        --mount type=bind,source=$HOME,target=/home/ort \
        -e JDK_JAVA_OPTIONS="--illegal-access=warn -Xmx5120m" \
        -e ORT_DATA_DIR="/home/ort/${ORT_HOME_PATH}" \
        -e POSTGRES_URL="${POSTGRES_URL}" \
        -e POSTGRES_USERNAME="${POSTGRES_USERNAME}" \
        -e POSTGRES_PASSWORD="${POSTGRES_PASSWORD}" \
        -u $(id -u):$(id -g) \
        $ORT_DOCKER_CLI_ARGS \
        $ORT_DOCKER_IMAGE \
        --$ORT_LOG_LEVEL \
        $ORT_CLI_ARGS \
        report \
        -i ${ORT_RESULTS_CURRENT_PATH/$USER/ort} \
        -o ${ORT_RESULTS_PATH/$USER/ort} \
        -f $ORT_REPORT_FORMATS \
        -O SpdxDocument=document.name="${SW_NAME_SAFE}" \
        ${ORT_CLI_REPORT_ARGS}
    - name: Remove current-result.yml file if present
      shell: bash
      run: |
        if [[ -f "$ORT_RESULTS_CURRENT_PATH" ]]; then
            rm -f $ORT_RESULTS_CURRENT_PATH
        fi
    - name: Upload ORT results
      uses: actions/upload-artifact@v4
      if: contains(inputs.run, 'upload-results')
      with:
        name: ${{ env.ORT_RESULTS_ARTIFACT_NAME }}
        path: ${{ env.ORT_RESULTS_PATH }}
        if-no-files-found: warn
    - name: Upload ORT advisor-result.json
      uses: actions/upload-artifact@v4
      if: contains(inputs.run, 'upload-advisor-result')
      with:
        name: "${{ env.ORT_RESULTS_ARTIFACT_NAME }}-advisor-result.json.zip"
        path: ${{ env.ORT_RESULTS_ADVISOR_PATH }}
        if-no-files-found: warn
    - name: Upload ORT evaluation-result.json
      uses: actions/upload-artifact@v4
      if: contains(inputs.run, 'upload-evaluation-result')
      with:
        name: "${{ env.ORT_RESULTS_ARTIFACT_NAME }}-evaluation-result.json.zip"
        path: ${{ env.ORT_RESULTS_EVALUATE_PATH }}
        if-no-files-found: warn
    - name: Upload ORT scan-result.json
      uses: actions/upload-artifact@v4
      if: contains(inputs.run, 'upload-scan-result')
      with:
        name: "${{ env.ORT_RESULTS_ARTIFACT_NAME }}-scan-result.json.zip"
        path: ${{ env.ORT_RESULTS_SCANNER_PATH }}
        if-no-files-found: warn
    - name: Conditionally fail action if returned violations from Evaluator exceeds severity threshold
      if: contains(inputs.fail-on, 'violations') && contains(env.ORT_CLI_EVALUATE_EXIT_CODE, 2)
      shell: bash
      run: |
        echo -e "\e[1;31m Failing action as Evaluator exceeded severity threshold... "
        exit 2
    - name: Conditionally fail action if returned issues from Advisor exceeds severity threshold
      if: contains(inputs.fail-on, 'issues') && contains(env.ORT_CLI_ADVISE_EXIT_CODE, 2)
      shell: bash
      run: |
        echo -e "\e[1;31m Failing action as Advisor exceeded severity threshold... "
        exit 2