Adopt OCSentinel script layout and add Gitea workflow

installer/runtime-run-ocsentinel.ps1

@@ -0,0 +1,136 @@
+param(
+    [int]$LookbackDays = 7,
+    [int]$TopCount = 10,
+    [string]$OutputPath = "..\reports\ocsentinel-summary.json",
+    [string]$ConfigPath = "..\config\ocsentinel-settings.json",
+    [string]$ClientConfigPath = "..\config\ocsentinel-client.json",
+    [string]$SecretPath = "",
+    [string]$VulnerabilityCsvPath = "",
+    [string]$MirrorRoot = "",
+    [ValidateSet("disabled", "auto", "required")]
+    [string]$UploadMode = "auto",
+    [switch]$FailOnAttacks,
+    [switch]$FailOnThreshold
+)
+
+$ErrorActionPreference = "Stop"
+
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$installRoot = Split-Path -Parent $scriptDir
+$appExe = Join-Path $installRoot "app\OCSentinelCli.exe"
+$outputFullPath = [System.IO.Path]::GetFullPath((Join-Path $scriptDir $OutputPath))
+
+function Resolve-PathLike {
+    param(
+        [Parameter(Mandatory)]
+        [string]$PathValue,
+        [Parameter(Mandatory)]
+        [string]$BasePath
+    )
+
+    if ([string]::IsNullOrWhiteSpace($PathValue)) {
+        return $PathValue
+    }
+
+    if ([System.IO.Path]::IsPathRooted($PathValue) -or $PathValue.StartsWith("\\")) {
+        return [System.IO.Path]::GetFullPath($PathValue)
+    }
+
+    return [System.IO.Path]::GetFullPath((Join-Path $BasePath $PathValue))
+}
+
+if (-not (Test-Path $appExe)) {
+    throw "Application executable not found: $appExe"
+}
+
+$arguments = @()
+
+$configFullPath = [System.IO.Path]::GetFullPath((Join-Path $scriptDir $ConfigPath))
+if ($UploadMode -eq "disabled") {
+    $arguments += "scan"
+}
+else {
+    $clientConfigFullPath = Resolve-PathLike -PathValue $ClientConfigPath -BasePath $scriptDir
+    $secretFullPath = if ([string]::IsNullOrWhiteSpace($SecretPath)) { "" } else { Resolve-PathLike -PathValue $SecretPath -BasePath $scriptDir }
+    $canUpload = (Test-Path $clientConfigFullPath) -and (-not [string]::IsNullOrWhiteSpace($secretFullPath)) -and (Test-Path $secretFullPath)
+
+    if ($UploadMode -eq "required" -and -not $canUpload) {
+        throw "UploadMode 'required' was set, but client config or protected secret is missing."
+    }
+
+    if ($canUpload) {
+        $arguments += "scan-and-upload"
+        $arguments += @("--client-config", $clientConfigFullPath, "--secret-path", $secretFullPath)
+    }
+    else {
+        $arguments += "scan"
+    }
+}
+
+$arguments += @(
+    "--lookback-days", $LookbackDays,
+    "--top", $TopCount,
+    "--output", $outputFullPath,
+    "--ninja-output"
+)
+
+if (Test-Path $configFullPath) {
+    $arguments += @("--config", $configFullPath)
+}
+
+if (-not [string]::IsNullOrWhiteSpace($VulnerabilityCsvPath)) {
+    $vulnerabilityCsvFullPath = Resolve-PathLike -PathValue $VulnerabilityCsvPath -BasePath $scriptDir
+    if (Test-Path $vulnerabilityCsvFullPath) {
+        $arguments += @("--vulnerability-csv", $vulnerabilityCsvFullPath)
+    }
+}
+
+if ($FailOnAttacks) {
+    $arguments += "--fail-on-attacks"
+}
+
+if ($FailOnThreshold) {
+    $arguments += "--fail-on-threshold"
+}
+
+& $appExe @arguments
+$exitCode = $LASTEXITCODE
+
+if (-not (Test-Path $outputFullPath)) {
+    throw "Expected report file was not created: $outputFullPath"
+}
+
+$report = Get-Content $outputFullPath -Raw | ConvertFrom-Json
+
+if (-not [string]::IsNullOrWhiteSpace($MirrorRoot)) {
+    Write-Host "Legacy mirror mode enabled."
+    $mirrorRootPath = Resolve-PathLike -PathValue $MirrorRoot -BasePath $scriptDir
+    if (-not (Test-Path $mirrorRootPath)) {
+        New-Item -ItemType Directory -Force -Path $mirrorRootPath | Out-Null
+    }
+    $mirrorPath = Join-Path $mirrorRootPath "$($report.MachineName).json"
+    Copy-Item -Path $outputFullPath -Destination $mirrorPath -Force
+    Write-Host "Mirrored report: $mirrorPath"
+}
+
+Write-Host ""
+Write-Host "OfficeCom Sentinel runner summary"
+Write-Host "Machine: $($report.MachineName)"
+Write-Host "Events: $($report.TotalEvents)"
+Write-Host "Unique IPs: $($report.UniqueIpCount)"
+Write-Host "Status: $($report.AlertState)"
+Write-Host "Reason: $($report.AlertReason)"
+Write-Host "Base status: $($report.BaseAlertState)"
+Write-Host "CVE findings: $($report.VulnerabilityCorrelation.TotalCount)"
+Write-Host "Critical/High CVEs: $($report.VulnerabilityCorrelation.CriticalCount)"
+Write-Host "Upload mode: $UploadMode"
+Write-Host "Report: $outputFullPath"
+
+if ($report.Errors.Count -gt 0) {
+    Write-Host "Warnings:"
+    foreach ($warningEntry in $report.Errors) {
+        Write-Host "- $warningEntry"
+    }
+}
+
+exit $exitCode