import groovy.transform.Field

@Field DEFAULT_SCANNER_IMAGE = '086679231553.dkr.ecr.us-east-1.amazonaws.com/security-scripts/github-vuln-scanner:latest'

def call(Map args = [:]) {
    assert env.CHANGE_ID : 'CHANGE_ID environment variable is not set. GitHub vulnerability scan can only be run in PR builds.'
    runV2(args)
}

private def runV2(Map args) {
    def scannerImage = args.scannerImage ?: DEFAULT_SCANNER_IMAGE
    def ecrRegion = scannerImage.split(/\./)[3]
    def ecrAccountId = scannerImage.split(/\./)[0]

    withEcr(registries: [[accountId: ecrAccountId, region: ecrRegion]]) {
        echo 'Pulling GitHub vulnerability scanner image'
        sh "docker pull ${scannerImage}"

        // Grant permissions to access the repository from inside the container.
        // Ignore errors, which may occur if a previous stage generated files which aren't owned by the Jenkins user.
        sh 'chmod -R a=rwX ./ || true'

        def credentials = [
            file(credentialsId: 'security-scripts-pde-github-api-key', variable: 'GITHUB_PRIVATE_KEY_FILE')
        ]
        def repoName = env.GIT_URL.split(/\//)[-1] - '.git'
        def repoOwner = args.repoOwner ?: env.GIT_URL.split(/\//)[-2].split(':')[-1]

        def environmentVariables = [
            GITHUB_PRIVATE_KEY_PATH: '/run/secrets/github_private_key',
            GITHUB_APP_ID          : '3600985',
            GITHUB_INSTALLATION_ID : '129508735',
            GITHUB_REPO_OWNER      : repoOwner,
            GITHUB_REPO            : repoName,
            BASE_PATH              : '/workspace',
            COMMIT_SHA             : env.GIT_COMMIT,
            BUILD_URL              : env.BUILD_URL,
            GITHUB_PR_NUM          : env.CHANGE_ID,
            GITHUB_PR_COMMENT      : env.GITHUB_COMMENT ?: ''
        ]

        if (args.projectDir) {
            environmentVariables['PROJECT_DIR'] = args.projectDir
        }

        if (args.excludedPath) {
            environmentVariables['EXCLUDED_PATH'] = "sonar-scanner-temp,dockerToEcr,${args.excludedPath}"
        } else {
            environmentVariables['EXCLUDED_PATH'] = 'sonar-scanner-temp,dockerToEcr'
        }

        if (args.logLevel) {
            environmentVariables['LOG_LEVEL'] = args.logLevel
        }

        def environmentVariableArgs = environmentVariables.collect { k, v -> "-e ${k}=\"${v}\"" }.join(' ')

        def cliFlags = '--post-comment'

        if (args.ux) {
            def ux = args.ux
            if (ux == 'rich') {
                throw new IllegalArgumentException(
                    "--ux rich is not compatible with --post-comment. Use --ux table (default) or --ux markdown."
                )
            }
            cliFlags += " --ux ${ux}"
        }
        if (args.skipPhrase) {
            cliFlags += " --skip-phrase \"${args.skipPhrase}\""
        }
        if (args.logLevel) {
            cliFlags += " --log-level ${args.logLevel}"
        }

        def uid = sh(script: "id -u", returnStdout: true).trim()
        def gid = sh(script: "id -g", returnStdout: true).trim()

        withCredentials(credentials) {
            echo "Running GitHub vulnerability scanner v2 for ${repoOwner}/${repoName}"
            sh """
              docker run --rm \
                --user ${uid}:${gid} \
                -v "\$(pwd):/workspace:ro" \
                -v "\${GITHUB_PRIVATE_KEY_FILE}:/run/secrets/github_private_key:ro" \
                ${environmentVariableArgs} \
                ${scannerImage} ${cliFlags}
            """
        }
    }
}