daily-snap-monitor.yml

name: Daily Snap Monitor

on:
  schedule:
    - cron: "17 3 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  monitor:
    runs-on: ubuntu-latest

    env:
      PACKAGE_NAME: cvecli
      CVE_ID: cve-2025-55182

    steps:
      - name: Initialize state
        shell: bash
        run: |
          echo "CVECLI_VERSION=unknown" >> "$GITHUB_ENV"
          echo "TEST_STATUS=failed" >> "$GITHUB_ENV"
          echo "CVE_OUTPUT_RETURNED=no" >> "$GITHUB_ENV"
          echo "CVE_COMMAND=cvecli --id ${CVE_ID}" >> "$GITHUB_ENV"

      - name: Setup snapd
        shell: bash
        run: |
          set -euo pipefail

          sudo apt-get update
          sudo apt-get install -y snapd

          sudo systemctl enable --now snapd.socket || true
          sudo systemctl restart snapd || true

          sudo ln -sf /var/lib/snapd/snap /snap || true
          echo "/snap/bin" >> "$GITHUB_PATH"

          snap version

      - name: Install or update cvecli
        shell: bash
        run: |
          set -euo pipefail

          if snap list "${PACKAGE_NAME}" >/dev/null 2>&1; then
            sudo snap refresh "${PACKAGE_NAME}" --channel=stable || \
            sudo snap refresh "${PACKAGE_NAME}" --channel=stable
          else
            sudo snap install "${PACKAGE_NAME}" --channel=stable || \
            sudo snap install "${PACKAGE_NAME}" --channel=stable
          fi

          command -v cvecli

      - name: Get version
        shell: bash
        run: |
          set -euo pipefail

          version="$(cvecli --version 2>/dev/null || true)"
          version="$(echo "$version" | head -n 1 | tr -d '\r')"

          if [ -z "$version" ]; then
            version="unknown"
          fi

          echo "CVECLI_VERSION=${version}" >> "$GITHUB_ENV"

      - name: Run CVE functional test
        shell: bash
        run: |
          set -euo pipefail

          set +e
          output="$(cvecli --id "${CVE_ID}" 2>&1)"
          rc=$?
          set -e

          printf '%s\n' "$output" > cve_output.txt

          stripped="$(printf '%s' "$output" | tr -d '\r' | tr -d '[:space:]')"
          lowered="$(printf '%s' "$output" | tr -d '\r' | tr '[:upper:]' '[:lower:]')"

          if [ $rc -ne 0 ]; then
            echo "TEST_STATUS=failed" >> "$GITHUB_ENV"
            echo "CVE_OUTPUT_RETURNED=no" >> "$GITHUB_ENV"
          elif [ -z "$stripped" ]; then
            echo "TEST_STATUS=failed" >> "$GITHUB_ENV"
            echo "CVE_OUTPUT_RETURNED=no" >> "$GITHUB_ENV"
          elif printf '%s' "$lowered" | grep -q "^[[:space:]]*error:\|failed to fetch cve\|network error\|invalid json"; then
            echo "TEST_STATUS=failed" >> "$GITHUB_ENV"
            echo "CVE_OUTPUT_RETURNED=yes" >> "$GITHUB_ENV"
          else
            echo "TEST_STATUS=success" >> "$GITHUB_ENV"
            echo "CVE_OUTPUT_RETURNED=yes" >> "$GITHUB_ENV"
          fi

      - name: Build Telegram message
        if: always()
        shell: bash
        run: |
          set -euo pipefail

          if [ "${TEST_STATUS}" = "success" ]; then
            STATUS="✅ Healthy"
          else
            STATUS="❌ Failed"
          fi

          MSG="$(printf '%s\n' \
            "Monitor: Snap" \
            "Status: ${STATUS}" \
            "Package: ${PACKAGE_NAME}" \
            "Version: ${CVECLI_VERSION}" \
            "CVE command: ${CVE_COMMAND}" \
            "Output returned: ${CVE_OUTPUT_RETURNED}" \
            "Repo: ${GITHUB_REPOSITORY}" \
            "Run: #${GITHUB_RUN_NUMBER}" \
            "SHA: ${GITHUB_SHA}" \
            "Branch: ${GITHUB_REF_NAME}")"

          echo "MESSAGE<<EOF" >> "$GITHUB_ENV"
          echo "$MSG" >> "$GITHUB_ENV"
          echo "EOF" >> "$GITHUB_ENV"

      - name: Send Telegram notification
        if: always()
        shell: bash
        env:
          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
        run: |
          set -euo pipefail

          curl -fsS --retry 3 --retry-all-errors \
            -X POST "https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendMessage" \
            -d "chat_id=${TELEGRAM_CHAT_ID}" \
            --data-urlencode "text=${MESSAGE}"

      - name: Fail workflow if unhealthy
        if: always()
        shell: bash
        run: |
          set -euo pipefail

          if [ "${TEST_STATUS}" != "success" ]; then
            exit 1
          fi