syft/.github/actions/bootstrap/action.yaml

name: "Bootstrap"
description: "Bootstrap all syft tools and dependencies on top of go-make's setup action"

# This action is a thin wrapper around anchore/go-make/.github/actions/setup which
# already handles checkout, setup-go, restore-only build/mod cache, and tool cache.
# We add the syft-specific extras here: apt packages and the test fixture cache.

inputs:
  cache-key-prefix:
    description: "Prefix all cache keys with this value (passed to go-make/setup)"
    required: true
    default: "v1"
  cache-enabled:
    description: "Enable build/mod and tool caching (passed to go-make/setup)"
    required: true
    default: "true"
  download-test-fixture-cache:
    description: "Download test fixture cache from OCI and github actions"
    required: true
    default: "false"
  bootstrap-apt-packages:
    description: "Space delimited list of tools to install via apt"
    default: "libxml2-utils"

runs:
  using: "composite"
  steps:
    - name: Setup go + go-make tooling
      uses: anchore/go-make/.github/actions/setup@cf465259f4c9f0b0b0bcb35164ede11f7dc6d9f6 # v0.9.6
      with:
        cache-key-prefix: ${{ inputs.cache-key-prefix }}
        cache-enabled: ${{ inputs.cache-enabled }}

    - name: Install binny-managed tools
      shell: bash
      run: make binny:install

    - name: Install apt packages
      if: inputs.bootstrap-apt-packages != ''
      shell: bash
      env:
        APT_PACKAGES: ${{ inputs.bootstrap-apt-packages }}
      run: |
        IFS=' ' read -ra packages <<< "$APT_PACKAGES"
        # the AMI already ships most of these, and `apt update` costs ~40MB of index (minutes,
        # when archive.ubuntu.com throttles us) to find that out. only touch apt if we must.
        missing=()
        for pkg in "${packages[@]}"; do
          dpkg -s "$pkg" >/dev/null 2>&1 || missing+=("$pkg")
        done
        if [ ${#missing[@]} -eq 0 ]; then
          echo "all apt packages already present: ${packages[*]}"
          exit 0
        fi
        DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y "${missing[@]}"

    # ORAS cache: restore-only on non-default branches / forks
    - name: Restore ORAS cache from github actions
      if: ${{ inputs.download-test-fixture-cache == 'true' && (github.ref != format('refs/heads/{0}', github.event.repository.default_branch) || github.event.repository.fork == true) }}
      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ${{ github.workspace }}/.tmp/oras-cache
        key: ${{ inputs.cache-key-prefix }}-oras-cache

    # ORAS cache: restore + save on the default branch of the canonical repo only.
    - name: Restore and save ORAS cache from github actions
      if: ${{ inputs.download-test-fixture-cache == 'true' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.event.repository.fork == false }}
      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
      with:
        path: ${{ github.workspace }}/.tmp/oras-cache
        key: ${{ inputs.cache-key-prefix }}-oras-cache

    - name: Download test fixture cache
      if: inputs.download-test-fixture-cache == 'true'
      shell: bash
      run: make download-test-fixture-cache