action.yml

name: 'cargo-oxidate'
description: 'Check Cargo dependency for packages that are too new (supply chain risk) or too old (staleness/CVE risk)'
author: 'Thanh Nguyen (timweri), Mitchell Grenier (obelisk)'

branding:
  icon: 'shield'
  color: 'orange'

inputs:
  cargo-lock-path:
    description: 'Path to the Cargo.lock file'
    required: false
    default: 'Cargo.lock'
  min-age-days:
    description: 'Minimum age in days. Packages newer than this are flagged (supply chain security).'
    required: false
  max-age-days:
    description: 'Maximum age in days. Packages older than this are flagged (staleness).'
    required: false
  exempt-packages:
    description: 'Newline-separated list of package names to exempt from checks'
    required: false
    default: ''
  exclude-missing:
    description: 'Exclude packages whose publish date cannot be determined from violations (by default they are included)'
    required: false
    default: 'false'
  timeout:
    description: 'HTTP request timeout in seconds'
    required: false
    default: '10'
  suggest-fix:
    description: 'For "too new" violations, suggest cargo update commands to downgrade to compliant versions'
    required: false
    default: 'false'
  cache-responses:
    description: 'Cache crates.io API responses between runs'
    required: false
    default: 'true'

runs:
  using: 'composite'
  steps:
    - name: Install Rust toolchain
      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

    - name: Cache cargo-oxidate binary
      id: cache-binary
      if: env.ACTION_REF != ''
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      env:
        ACTION_REF: ${{ github.action_ref }}
      with:
        path: ~/.cargo-oxidate-bin
        key: cargo-oxidate-bin-v1-${{ runner.os }}-${{ runner.arch }}-${{ env.ACTION_REF }}

    - name: Build cargo-oxidate
      if: steps.cache-binary.outputs.cache-hit != 'true'
      shell: bash
      env:
        ACTION_PATH: ${{ github.action_path }}
      run: |
        cd "$ACTION_PATH"
        cargo build --release
        mkdir -p ~/.cargo-oxidate-bin
        cp target/release/cargo-oxidate ~/.cargo-oxidate-bin/

    - name: Resolve cache path
      if: inputs.cache-responses == 'true'
      id: cache-path
      shell: bash
      run: echo "path=$HOME/.cargo-oxidate-cache/responses.json" >> "$GITHUB_OUTPUT"

    - name: Cache crates.io API responses
      if: inputs.cache-responses == 'true'
      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
      with:
        path: ${{ steps.cache-path.outputs.path }}
        key: cargo-oxidate-responses-v1-${{ runner.os }}-${{ hashFiles(inputs.cargo-lock-path) }}
        restore-keys: |
          cargo-oxidate-responses-v1-${{ runner.os }}-

    - name: Run cargo-oxidate
      shell: bash
      env:
        INPUT_CARGO_LOCK_PATH: ${{ inputs.cargo-lock-path }}
        INPUT_MIN_AGE_DAYS: ${{ inputs.min-age-days }}
        INPUT_MAX_AGE_DAYS: ${{ inputs.max-age-days }}
        INPUT_EXEMPT_PACKAGES: ${{ inputs.exempt-packages }}
        INPUT_EXCLUDE_MISSING: ${{ inputs.exclude-missing }}
        INPUT_TIMEOUT: ${{ inputs.timeout }}
        INPUT_SUGGEST_FIX: ${{ inputs.suggest-fix }}
        CARGO_OXIDATE_CACHE_PATH: ${{ steps.cache-path.outputs.path }}
      run: |
        # Ensure cache directory exists
        if [ -n "$CARGO_OXIDATE_CACHE_PATH" ]; then
          mkdir -p "$(dirname "$CARGO_OXIDATE_CACHE_PATH")"
        fi

        ARGS=("$INPUT_CARGO_LOCK_PATH")

        if [ -n "$INPUT_MIN_AGE_DAYS" ]; then
          ARGS+=("--min-age-days" "$INPUT_MIN_AGE_DAYS")
        fi

        if [ -n "$INPUT_MAX_AGE_DAYS" ]; then
          ARGS+=("--max-age-days" "$INPUT_MAX_AGE_DAYS")
        fi

        if [ "$INPUT_EXCLUDE_MISSING" = "true" ]; then
          ARGS+=("--exclude-missing")
        fi

        if [ -n "$INPUT_TIMEOUT" ]; then
          ARGS+=("--timeout" "$INPUT_TIMEOUT")
        fi

        if [ "$INPUT_SUGGEST_FIX" = "true" ]; then
          ARGS+=("--suggest-fix")
        fi

        # Convert multiline exempt-packages input to comma-separated
        if [ -n "$INPUT_EXEMPT_PACKAGES" ]; then
          EXEMPT=$(echo "$INPUT_EXEMPT_PACKAGES" | tr '\n' ',' | sed 's/,*$//')
          if [ -n "$EXEMPT" ]; then
            ARGS+=("--exempt" "$EXEMPT")
          fi
        fi

        ~/.cargo-oxidate-bin/cargo-oxidate "${ARGS[@]}"