Analysis-Repo.yml

name: Script Analysis - Repo

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  scan-all:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      # ===============================
      # PowerShell Analysis
      # ===============================
      - name: Install PSScriptAnalyzer
        run: pwsh -Command "Install-Module -Name PSScriptAnalyzer -Force -Scope CurrentUser"

      - name: Analyze all .ps1 scripts and output formatted markdown
        shell: bash
        run: |
          pwsh -Command "Invoke-ScriptAnalyzer -Path . -Recurse | ConvertTo-Json -Depth 5" > psa_result.json

          cat <<'EOF' > format_psa.ps1
          $results = Get-Content psa_result.json | ConvertFrom-Json
          $md = @()
          $md += '## PSScriptAnalyzer Results'
          $md += ''
          if ($results.Count -eq 0) {
            $md += 'No issues detected.'
          } else {
            $md += '| File | Line | Rule | Severity | Message |'
            $md += '| ---- | ---- | ---- | -------- | ------- |'
            foreach ($item in $results) {
              $file = if ($item.ScriptName) { $item.ScriptName } else { '' }
              $line = if ($item.Line) { $item.Line } else { '' }
              $rule = if ($item.RuleName) { $item.RuleName } else { '' }
              $severity = switch ($item.Severity) { 0 {'Info'}; 1 {'Warning'}; 2 {'Error'}; default { $item.Severity } }
              $msg = ($item.Message -replace '\|','\\|') -replace '\r?\n',' '
              if ($msg.Length -gt 120) { $msg = $msg.Substring(0,117) + '...' }
              $md += "| $file | $line | $rule | $severity | $msg |"
            }
          }
          Set-Content -Path psa_result.md -Value ($md -join "`n")
          EOF

          pwsh -File format_psa.ps1

          echo '====== PSScriptAnalyzer Markdown Table ======'
          cat psa_result.md
          echo '============================================='

      - name: Generate FIXIT_Powershell.md from analysis results
        shell: pwsh
        run: |
          $results = Get-Content psa_result.json | ConvertFrom-Json
          $categories = @{"Error"=@(); "Warning"=@(); "Info"=@()}
          foreach ($item in $results) {
            $sev = switch ($item.Severity) {
              0 {'Info'}
              1 {'Warning'}
              2 {'Error'}
              default {$item.Severity}
            }
            $cat = $categories[$sev]
            $cat += $item
            $categories[$sev] = $cat
          }

          function Format-Table ($items, $title) {
            if ($items.Count -eq 0) { return "`n### $title`n`n_No issues found under this category._`n" }
            $sorted = $items | Sort-Object ScriptName, Line
            $table = @()
            $table += "`n### $title`n"
            $table += "| File | Line | Rule | Message |"
            $table += "| ---- | ---- | ---- | ------- |"
            foreach ($item in $sorted) {
              $file = $item.ScriptName
              $line = $item.Line
              $rule = $item.RuleName
              $msg = ($item.Message -replace '\|','\\|') -replace '\r?\n',' '
              if ($msg.Length -gt 120) { $msg = $msg.Substring(0,117) + '...' }
              $table += "| $file | $line | $rule | $msg |"
            }
            return $table -join "`n"
          }

          $fixit = @()
          $fixit += "# PowerShell Script Issues Report"
          $fixit += "_This file is generated automatically by Script Analysis workflow_"
          $fixit += ""

          $fixit += Format-Table $categories['Error'] "Errors"
          $fixit += Format-Table $categories['Warning'] "Warnings"
          $fixit += Format-Table $categories['Info'] "Info"

          Set-Content -Path FIXIT_Powershell.md -Value ($fixit -join "`n")

      # ===============================
      # Bash Analysis
      # ===============================
      - name: Install ShellCheck
        run: sudo apt-get update && sudo apt-get install -y shellcheck jq

      - name: Analyze all .sh scripts and output formatted markdown
        shell: bash
        run: |
          sh_files=$(find . -type f -name "*.sh")
          if [ -z "$sh_files" ]; then
            echo "No .sh files found."
            echo "## ShellCheck Results\n\nNo issues detected." > bash_result.md
            jq -n '[]' > bash_result.json
          else
            shellcheck -f json $sh_files > bash_result.json || true

          cat <<'EOF' > format_bash.sh
          #!/usr/bin/env bash
          results=$(cat bash_result.json | jq -c '.[]')
          echo "## ShellCheck Results"
          echo
          if [ -z "$results" ]; then
            echo "No issues detected."
            exit 0
          fi
          echo "| File | Line | Level | Code | Message |"
          echo "| ---- | ---- | ----- | ---- | ------- |"
          echo "$results" | while read -r item; do
            file=$(echo "$item" | jq -r '.file')
            line=$(echo "$item" | jq -r '.line')
            level=$(echo "$item" | jq -r '.level')
            code=$(echo "$item" | jq -r '.code')
            msg=$(echo "$item" | jq -r '.message' | tr '\n' ' ' | sed 's/|/\\|/g')
            [ ${#msg} -gt 120 ] && msg="${msg:0:117}..."
            echo "| $file | $line | $level | SC$code | $msg |"
          done
          EOF

            bash format_bash.sh > bash_result.md
          fi

          echo '====== ShellCheck Markdown Table ======'
          cat bash_result.md
          echo '======================================'


      - name: Generate FIXIT_Bash.md from analysis results
        shell: bash
        run: |
          echo "# Bash Script Issues Report" > FIXIT_Bash.md
          echo "_This file is generated automatically by Script Analysis workflow_" >> FIXIT_Bash.md
          echo "" >> FIXIT_Bash.md

          if [ ! -s bash_result.json ]; then
            echo "No issues detected." >> FIXIT_Bash.md
          else
            errors=$(jq '[.[] | select(.level=="error")]' bash_result.json)
            warnings=$(jq '[.[] | select(.level=="warning")]' bash_result.json)
            infos=$(jq '[.[] | select(.level=="info")]' bash_result.json)

            make_table() {
              local json="$1"
              local title="$2"
              count=$(echo "$json" | jq 'length')
              echo "### $title"
              if [ "$count" -eq 0 ]; then
                echo "_No issues found under this category._"
              else
                echo "| File | Line | Code | Message |"
                echo "| ---- | ---- | ---- | ------- |"
                echo "$json" | jq -c '.[]' | while read -r item; do
                  file=$(echo "$item" | jq -r '.file')
                  line=$(echo "$item" | jq -r '.line')
                  code=$(echo "$item" | jq -r '.code')
                  msg=$(echo "$item" | jq -r '.message' | tr '\n' ' ' | sed 's/|/\\|/g')
                  [ ${#msg} -gt 120 ] && msg="${msg:0:117}..."
                  echo "| $file | $line | SC$code | $msg |"
                done
              fi
              echo
            }

            make_table "$errors" "Errors" >> FIXIT_Bash.md
            make_table "$warnings" "Warnings" >> FIXIT_Bash.md
            make_table "$infos" "Info" >> FIXIT_Bash.md
          fi

      # ===============================
      # Commit results
      # ===============================
      - name: Commit and push FIXIT reports if changed
        env:
          GITHUB_TOKEN: ${{ secrets.AWSR }}
        run: |
          git config user.name "github-actions"
          git config user.email "github-actions@github.com"
          BRANCH=${{ github.ref_name }}
          git add FIXIT_Powershell.md FIXIT_Bash.md || true
          if git diff --cached --quiet; then
            echo "No changes to FIXIT reports."
          else
            git commit -m "Update FIXIT reports from scheduled/dispatch scan"
            git pull --rebase origin "$BRANCH"
            git push origin HEAD:"$BRANCH"
          fi