validate.sh

#!/usr/bin/env bash
#
# Copyright 2026 ABSA Group Limited
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

set -uo pipefail

INPUT_CERTIFICATES="${INPUT_CERTIFICATES:?'INPUT_CERTIFICATES environment variable is required'}"
INPUT_WARNING_DAYS="${INPUT_WARNING_DAYS:-30}"
INPUT_FAIL_ON_WARN="${INPUT_FAIL_ON_WARN:-false}"
GITHUB_STEP_SUMMARY="${GITHUB_STEP_SUMMARY:-/dev/null}"
GITHUB_OUTPUT="${GITHUB_OUTPUT:-/dev/null}"

FAIL_ON_WARN="${INPUT_FAIL_ON_WARN,,}"
if [[ "$FAIL_ON_WARN" != "true" && "$FAIL_ON_WARN" != "false" ]]; then
  echo "::error::INPUT_FAIL_ON_WARN must be 'true' or 'false', got: '$INPUT_FAIL_ON_WARN'"
  exit 1
fi

if [[ ! "$INPUT_WARNING_DAYS" =~ ^[0-9]+$ ]]; then
  echo "::error::INPUT_WARNING_DAYS must be a non-negative integer, got: '$INPUT_WARNING_DAYS'"
  exit 1
fi

if ! echo "$INPUT_CERTIFICATES" | jq -e 'type == "array"' > /dev/null 2>&1; then
  echo "::error::INPUT_CERTIFICATES must be a valid JSON array, got: '$INPUT_CERTIFICATES'"
  exit 1
fi

CERTIFICATES="$INPUT_CERTIFICATES"
WARNING_DAYS=$((10#$INPUT_WARNING_DAYS))

# Parse JSON array into a bash array
mapfile -t CERT_FILES < <(echo "$CERTIFICATES" | jq -r '.[]')

if [[ ${#CERT_FILES[@]} -eq 0 ]]; then
  echo "::error::No certificate files provided in the JSON array."
  exit 1
fi

echo "🔍 Found ${#CERT_FILES[@]} certificate(s) to validate."

WARN_COUNT=0
FAIL_COUNT=0
declare -a SUMMARY_ROWS=()

# Associative arrays for grouping certs by subject
declare -A SUBJECT_BEST_EXPIRY=()       # subject -> best (latest) notAfter epoch
declare -A SUBJECT_BEST_STATUS=()       # subject -> best status (OK, WARN, FAIL)
declare -A SUBJECT_CERTS=()             # subject -> space-separated list of cert indices
declare -a CERT_STATUS=()               # per-cert status
declare -a CERT_SUBJECT=()              # per-cert subject
declare -a CERT_EXPIRY_EPOCH=()         # per-cert expiry epoch
declare -a CERT_NAME_ARR=()             # per-cert basename

# -------------------------------------------------------
# Helper: convert OpenSSL date string to epoch
# Format: "Sep 18 08:57:36 2025 GMT"
# -------------------------------------------------------
convert_cert_date_to_epoch() {
  local cert_date="$1"
  if [[ $cert_date =~ ^([A-Z][a-z]+)\ +([0-9]+)\ +([0-9]{2}):([0-9]{2}):([0-9]{2})\ +([0-9]{4})\ +GMT$ ]]; then
    local month="${BASH_REMATCH[1]}"
    local day="${BASH_REMATCH[2]}"
    local hour="${BASH_REMATCH[3]}"
    local minute="${BASH_REMATCH[4]}"
    local second="${BASH_REMATCH[5]}"
    local year="${BASH_REMATCH[6]}"

    case "$month" in
      Jan) month_num=01 ;; Feb) month_num=02 ;; Mar) month_num=03 ;;
      Apr) month_num=04 ;; May) month_num=05 ;; Jun) month_num=06 ;;
      Jul) month_num=07 ;; Aug) month_num=08 ;; Sep) month_num=09 ;;
      Oct) month_num=10 ;; Nov) month_num=11 ;; Dec) month_num=12 ;;
      *) echo "Invalid month: $month" >&2; return 1 ;;
    esac

    day=$(printf "%02d" "$day")

    # Works on both Linux (GNU date) and macOS (BSD date)
    date -u -d "${year}-${month_num}-${day} ${hour}:${minute}:${second}" +%s 2>/dev/null || \
    date -u -j -f "%Y-%m-%d %H:%M:%S" "${year}-${month_num}-${day} ${hour}:${minute}:${second}" +%s 2>/dev/null
  else
    echo "Invalid date format: $cert_date" >&2
    return 1
  fi
}

# -------------------------------------------------------
# Validate a single certificate and output its info.
# Sets global variables: _STATUS, _SUBJECT, _EXPIRY_EPOCH
# -------------------------------------------------------
validate_cert() {
  local CERT_FILE="$1"
  local CERT_NAME
  CERT_NAME=$(basename "$CERT_FILE")

  _STATUS="FAIL"
  _SUBJECT=""
  _EXPIRY_EPOCH=0

  echo ""
  echo "========================================"
  echo "📜 Validating: $CERT_NAME"
  echo "========================================"

  if [[ ! -f "$CERT_FILE" ]]; then
    echo "::warning file=${CERT_FILE}::Certificate file not found: $CERT_FILE"
    echo "❌ Certificate file not found: $CERT_FILE"
    return
  fi

  if ! CERT_INFO=$(openssl x509 -in "$CERT_FILE" -noout -subject -issuer -dates 2>&1); then
    echo "::error file=${CERT_FILE}::Failed to parse certificate: $CERT_FILE"
    echo "❌ Failed to parse certificate: $CERT_FILE"
    return
  fi

  echo "$CERT_INFO"
  echo "----------------------------------------"

  NOT_BEFORE=$(echo "$CERT_INFO" | grep "notBefore=" | sed 's/notBefore=//')
  NOT_AFTER=$(echo "$CERT_INFO"  | grep "notAfter="  | sed 's/notAfter=//')
  ISSUER=$(echo "$CERT_INFO"     | grep "issuer="    | sed 's/issuer=//')
  _SUBJECT=$(echo "$CERT_INFO"   | grep "subject="   | sed 's/subject=//')

  NOT_BEFORE_EPOCH=$(convert_cert_date_to_epoch "$NOT_BEFORE") || { return; }
  NOT_AFTER_EPOCH=$(convert_cert_date_to_epoch  "$NOT_AFTER")  || { return; }
  CURRENT_EPOCH=$(date +%s)

  _EXPIRY_EPOCH=$NOT_AFTER_EPOCH
  DAYS_UNTIL_EXPIRY=$(( (NOT_AFTER_EPOCH - CURRENT_EPOCH) / 86400 ))

  echo "🏛️  Certificate Authority: $ISSUER"
  echo ""

  if [[ $CURRENT_EPOCH -lt $NOT_BEFORE_EPOCH ]]; then
    echo "::warning file=${CERT_FILE}::Certificate is not yet valid. Valid from: $NOT_BEFORE"
    echo "❌ Certificate is not yet valid. Valid from: $NOT_BEFORE"
    _STATUS="FAIL"
    return
  fi

  if [[ $CURRENT_EPOCH -gt $NOT_AFTER_EPOCH ]]; then
    echo "::warning file=${CERT_FILE}::Certificate has EXPIRED on: $NOT_AFTER"
    echo "❌ Certificate EXPIRED on: $NOT_AFTER"
    _STATUS="EXPIRED"
    return
  fi

  if [[ $DAYS_UNTIL_EXPIRY -le $WARNING_DAYS ]]; then
    echo "::warning file=${CERT_FILE}::Certificate will expire in $DAYS_UNTIL_EXPIRY days on $NOT_AFTER"
    echo "⚠️  WARNING: Certificate will expire in $DAYS_UNTIL_EXPIRY days on $NOT_AFTER"
    _STATUS="WARN"
    return
  fi

  echo "✅ Certificate is valid. Expires in $DAYS_UNTIL_EXPIRY days on $NOT_AFTER"
  _STATUS="OK"
}

# -------------------------------------------------------
# Phase 1: Validate every certificate individually
# -------------------------------------------------------
IDX=0
for CERT_FILE in "${CERT_FILES[@]}"; do
  validate_cert "$CERT_FILE"

  CERT_STATUS+=("$_STATUS")
  CERT_SUBJECT+=("$_SUBJECT")
  CERT_EXPIRY_EPOCH+=("$_EXPIRY_EPOCH")
  CERT_NAME_ARR+=("$(basename "$CERT_FILE")")

  # Group by subject — track the best (latest-expiring, valid) cert per subject
  SUBJ="$_SUBJECT"
  if [[ -n "$SUBJ" ]]; then
    SUBJECT_CERTS["$SUBJ"]="${SUBJECT_CERTS["$SUBJ"]:-} $IDX"

    # Track best status per subject group
    PREV_STATUS="${SUBJECT_BEST_STATUS["$SUBJ"]:-NONE}"
    PREV_EXPIRY="${SUBJECT_BEST_EXPIRY["$SUBJ"]:-0}"

    # A cert is "better" if it's valid (OK or WARN) and expires later
    if [[ "$_STATUS" == "OK" || "$_STATUS" == "WARN" ]]; then
      if [[ "$PREV_STATUS" != "OK" || "$_EXPIRY_EPOCH" -gt "$PREV_EXPIRY" ]]; then
        SUBJECT_BEST_STATUS["$SUBJ"]="$_STATUS"
        SUBJECT_BEST_EXPIRY["$SUBJ"]="$_EXPIRY_EPOCH"
      fi
    fi
  fi

  IDX=$((IDX + 1))
done

# -------------------------------------------------------
# Phase 2: Determine final status per cert considering
#          whether a newer valid replacement exists
# -------------------------------------------------------
for ((i=0; i<${#CERT_STATUS[@]}; i++)); do
  STATUS="${CERT_STATUS[$i]}"
  CERT_NAME="${CERT_NAME_ARR[$i]}"
  SUBJ="${CERT_SUBJECT[$i]}"
  GROUP_BEST="${SUBJECT_BEST_STATUS["$SUBJ"]:-NONE}"

  case "$STATUS" in
    OK)
      SUMMARY_ROWS+=("| \`$CERT_NAME\` | ✅ Valid |")
      ;;
    WARN)
      # If there's a newer valid (OK) cert in the same subject group, downgrade to info
      if [[ "$GROUP_BEST" == "OK" && "${SUBJECT_BEST_EXPIRY["$SUBJ"]}" -gt "${CERT_EXPIRY_EPOCH[$i]}" ]]; then
        SUMMARY_ROWS+=("| \`$CERT_NAME\` | ⚠️ Expiring Soon (newer replacement exists) |")
      else
        SUMMARY_ROWS+=("| \`$CERT_NAME\` | ⚠️ Expiring Soon |")
        WARN_COUNT=$((WARN_COUNT + 1))
      fi
      ;;
    EXPIRED)
      # If there's a valid replacement in the same subject group, don't fail
      if [[ "$GROUP_BEST" == "OK" || "$GROUP_BEST" == "WARN" ]]; then
        SUMMARY_ROWS+=("| \`$CERT_NAME\` | ⏳ Expired (newer replacement exists) |")
      else
        SUMMARY_ROWS+=("| \`$CERT_NAME\` | ❌ Expired |")
        FAIL_COUNT=$((FAIL_COUNT + 1))
      fi
      ;;
    *)
      SUMMARY_ROWS+=("| \`$CERT_NAME\` | ❌ Failed |")
      FAIL_COUNT=$((FAIL_COUNT + 1))
      ;;
  esac
done

# -------------------------------------------------------
# Print summary table to stdout
# -------------------------------------------------------
echo ""
echo "========================================"
echo "📋 Certificate Validation Summary"
echo "========================================"
printf "| %-60s | %-45s |\n" "Certificate" "Status"
printf "|-%s-|-%s-|\n" "$(printf '%0.s-' {1..60})" "$(printf '%0.s-' {1..45})"
for row in "${SUMMARY_ROWS[@]}"; do
  echo "$row"
done
echo ""

# -------------------------------------------------------
# Write summary to GitHub Step Summary for a nice UI table
# -------------------------------------------------------
{
  echo "## 🔐 Certificate Validation Summary"
  echo ""
  echo "| Certificate | Status |"
  echo "|-------------|--------|"
  for row in "${SUMMARY_ROWS[@]}"; do
    echo "$row"
  done
  echo ""
  if [[ $FAIL_COUNT -gt 0 ]]; then
    echo "> ❌ **$FAIL_COUNT certificate(s) FAILED validation with no valid replacement.**"
  elif [[ $WARN_COUNT -gt 0 ]]; then
    echo "> ⚠️ **$WARN_COUNT certificate(s) are nearing expiry with no newer replacement.**"
  else
    echo "> ✅ **All certificate(s) are valid (or have valid replacements).**"
  fi
  echo ""
  echo "| Metric | Count |"
  echo "|--------|-------|"
  echo "| Failed | $FAIL_COUNT |"
  echo "| Warnings | $WARN_COUNT |"
} >> "$GITHUB_STEP_SUMMARY"

# -------------------------------------------------------
# Emit outputs for programmatic use
# -------------------------------------------------------
if [[ $FAIL_COUNT -gt 0 || ( "$FAIL_ON_WARN" == "true" && $WARN_COUNT -gt 0 ) ]]; then
  RESULT="fail"
elif [[ $WARN_COUNT -gt 0 ]]; then
  RESULT="warn"
else
  RESULT="pass"
fi

echo "result=$RESULT" >> "$GITHUB_OUTPUT"
echo "fail_count=$FAIL_COUNT" >> "$GITHUB_OUTPUT"
echo "warn_count=$WARN_COUNT" >> "$GITHUB_OUTPUT"

# -------------------------------------------------------
# Enforce fail_on_warn if requested
# -------------------------------------------------------
if [[ "$FAIL_ON_WARN" == "true" && $WARN_COUNT -gt 0 ]]; then
  echo "❌ fail_on_warn=true: $WARN_COUNT certificate(s) are nearing expiry. Failing the job."
  exit 1
fi

# -------------------------------------------------------
# Final exit code
# -------------------------------------------------------
if [[ $FAIL_COUNT -gt 0 ]]; then
  echo "❌ $FAIL_COUNT certificate(s) FAILED with no valid replacement. See details above."
  exit 1
elif [[ $WARN_COUNT -gt 0 ]]; then
  echo "⚠️  All certificates valid, but $WARN_COUNT certificate(s) are nearing expiry with no newer replacement."
  exit 0
else
  echo "✅ All certificate(s) are valid (or have valid replacements)."
  exit 0
fi