From f48dc710ab1733eef39ed9ed0caf924b14294e45 Mon Sep 17 00:00:00 2001
From: tanya732 <sinha.tanya26@gmail.com>
Date: Wed, 1 Jul 2026 17:04:57 +0530
Subject: [PATCH] chore: Migrate RL Scanner to useable actions

---
 .github/actions/rl-scanner/action.yml | 66 ---------------------------
 .github/workflows/release.yml         |  2 +
 .github/workflows/rl-secure.yml       | 16 +++++--
 3 files changed, 13 insertions(+), 71 deletions(-)
 delete mode 100644 .github/actions/rl-scanner/action.yml

diff --git a/.github/actions/rl-scanner/action.yml b/.github/actions/rl-scanner/action.yml
deleted file mode 100644
index fbf81217..00000000
--- a/.github/actions/rl-scanner/action.yml
+++ /dev/null
@@ -1,66 +0,0 @@
-name: 'Reversing Labs Scanner'
-description: 'Runs the Reversing Labs scanner on a specified artifact.'
-inputs:
-  artifact-path:
-    description: 'Path to the artifact to be scanned.'
-    required: true
-  version:
-    description: 'Version of the artifact.'
-    required: true
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.10'
-
-    - name: Install Python dependencies
-      shell: bash
-      run: |
-        pip install boto3 requests
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v1
-      with:
-        role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
-        aws-region: us-east-1
-        mask-aws-account-id: true
-
-    - name: Install RL Wrapper
-      shell: bash
-      run: |
-        pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
-    - name: Run RL Scanner
-      shell: bash
-      env:
-        RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
-        RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
-        SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
-        PYTHONUNBUFFERED: 1
-      run: |
-        if [ ! -f "${{ inputs.artifact-path }}" ]; then
-          echo "Artifact not found: ${{ inputs.artifact-path }}"
-          exit 1
-        fi
-        rl-wrapper \
-          --artifact "${{ inputs.artifact-path }}" \
-          --name "${{ github.event.repository.name }}" \
-          --version "${{ inputs.version }}" \
-          --repository "${{ github.repository }}" \
-          --commit "${{ github.sha }}" \
-          --build-env "github_actions" \
-          --suppress_output
-        # Check the outcome of the scanner
-        if [ $? -ne 0 ]; then
-          echo "RL Scanner failed."
-          echo "scan-status=failed" >> $GITHUB_ENV
-          exit 1
-        else
-          echo "RL Scanner passed."
-          echo "scan-status=success" >> $GITHUB_ENV
-        fi
-outputs:
-  scan-status:
-    description: 'The outcome of the scan process.'
-    value: ${{ env.scan-status }}
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2b00e426..ea49635c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,9 +24,11 @@ jobs:
       RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
       RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
       SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
+      SIGNAL_HANDLER_DOMAIN: ${{ secrets.SIGNAL_HANDLER_DOMAIN }}
       PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
       PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
       PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
+      PRODSEC_PYTHON_TOOLS_REPO: ${{ secrets.PRODSEC_PYTHON_TOOLS_REPO }}
   release:
     uses: ./.github/workflows/java-release.yml
     needs: rl-scanner
diff --git a/.github/workflows/rl-secure.yml b/.github/workflows/rl-secure.yml
index 4af4af64..8af81d7c 100644
--- a/.github/workflows/rl-secure.yml
+++ b/.github/workflows/rl-secure.yml
@@ -16,12 +16,16 @@ on:
         required: true
       SIGNAL_HANDLER_TOKEN:
         required: true
+      SIGNAL_HANDLER_DOMAIN:
+        required: true
       PRODSEC_TOOLS_USER:
         required: true
       PRODSEC_TOOLS_TOKEN:
         required: true
       PRODSEC_TOOLS_ARN:
         required: true
+      PRODSEC_PYTHON_TOOLS_REPO:
+        required: true
 
 jobs:
   checkout-build-scan-only:
@@ -58,17 +62,19 @@ jobs:
 
       - name: Run RL Scanner
         id: rl-scan-conclusion
-        uses: ./.github/actions/rl-scanner
+        uses: auth0/devsecops-tooling/.github/actions/rl-scan@main
         with:
-          artifact-path: "$(pwd)/${{ inputs.artifact-name }}"
-          version: "${{ steps.get_version.outputs.version }}"
-        env:
+          artifact-name: "${{ github.event.repository.name }}"
+          artifact-path: "${{ github.workspace }}/${{ inputs.artifact-name }}"
+          version: ${{ steps.get_version.outputs.version }}
           RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
           RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
           SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
+          SIGNAL_HANDLER_DOMAIN: ${{ secrets.SIGNAL_HANDLER_DOMAIN }}
+          PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
           PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
           PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
-          PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
+          PRODSEC_PYTHON_TOOLS_REPO: ${{ secrets.PRODSEC_PYTHON_TOOLS_REPO }}
 
       - name: Output scan result
         run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV
\ No newline at end of file