validate.yml

on:
  pull_request_review:
    types: [submitted]

permissions:
  contents: read

jobs:
  validate:
    if: github.event.review.state == 'approved'
    name: Validate
    runs-on: ubuntu-latest
    env:
      API_HOST: ${{ secrets.API_HOST }}
      API_TOKEN: ${{ secrets.API_TOKEN }}
    steps:
      - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit
      - name: Validate Secrets
        if: ${{ env.API_HOST == '' || env.API_TOKEN == '' }}
        run: |
          echo "API_HOST or API_TOKEN not set"
          exit 0

      - name: Checkout panther-analysis
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4.1.7

      - name: Set python version
        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5.2.0
        with:
          python-version: "3.11"

      - name: Install pipenv
        run: pip install pipenv

      - name: Setup venv
        run: make venv

      - name: validate
        run: |
          pipenv run panther_analysis_tool validate --api-host ${{ env.API_HOST }} --api-token ${{ env.API_TOKEN }}