mine.yml

name: mine (corpus)

# On-demand corpus mining: clone one public C# repo and run the Own.NET leak
# check over it, uploading a structured report. Evaluation tooling for the
# analyser — see docs/notes/mining.md. One repo per run (be a good citizen).
#
# Trigger from the Actions tab ("Run workflow") or the API. Inputs are passed to
# the miner via env (never interpolated into the shell) to avoid script injection.

on:
  workflow_dispatch:
    inputs:
      repo:
        description: "Target: owner/repo (e.g. DapperLib/Dapper) or a git URL"
        required: true
      ref:
        description: "Branch / tag / sha to mine (optional, default: repo HEAD)"
        required: false
        default: ""
      paths:
        description: "Subdir of the target to scan (optional, default: whole repo)"
        required: false
        default: ""

permissions:
  contents: read

jobs:
  mine:
    name: mine ${{ inputs.repo }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.13"
      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
        with:
          dotnet-version: "8.0.x"
      - name: Mine the target
        env:
          REPO: ${{ inputs.repo }}
          REF: ${{ inputs.ref }}
          PATHS: ${{ inputs.paths }}
        run: |
          args=()
          [[ -n "$REF" ]]   && args+=(--ref "$REF")
          [[ -n "$PATHS" ]] && args+=(--paths "$PATHS")
          scripts/mine.sh "${args[@]}" "$REPO"
      - name: Publish the report to the run summary
        if: always()
        run: |
          report=$(find corpus/mined -name report.md -type f 2>/dev/null | head -1 || true)
          findings=$(find corpus/mined -name findings.txt -type f 2>/dev/null | head -1 || true)
          if [[ -n "$report" ]]; then
            cat "$report" >> "$GITHUB_STEP_SUMMARY"
            # Also echo to stdout so the report is readable straight from the job
            # log (the API/agent eval loop reads logs, not the summary or artifact).
            echo "::group::report.md"; cat "$report"; echo "::endgroup::"
          else
            echo "no report produced (see the Mine step log)" >> "$GITHUB_STEP_SUMMARY"
          fi
          if [[ -n "$findings" ]]; then
            echo "::group::findings.txt"; cat "$findings"; echo "::endgroup::"
          fi
      - name: Upload the report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: mine-report
          path: |
            corpus/mined/*/report.md
            corpus/mined/*/report.json
            corpus/mined/*/findings.txt
            corpus/mined/*/extract.log
          if-no-files-found: warn