sec-actions/.gitea/workflows/ci.yaml

name: CI

on:
  pull_request:

jobs:
  test-setup-trivy:
    strategy:
      matrix:
        arch: [amd64, arm64]
    name: Test Setup Trivy ${{ matrix.arch }}
    runs-on:
      - ubuntu-latest
      - linux_${{ matrix.arch }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Setup Trivy
        uses: ./setup-trivy
      - name: Run Trivy
        run: trivy --version

  test-setup-db:
    name: Test Setup DB
    runs-on:
      - ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: ./setup-trivy
      - name: Setup DB
        id: setup-db
        uses: ./setup-db
      - name: Run Trivy
        run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .

  test-get-images-from-files:
    name: Test Get Images From Files
    runs-on:
      - ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - id: giff
        uses: ./get-images-from-files
        with:
          files: |
            - get-images-from-files/test.Dockerfile
            - get-images-from-files/test-deployment.yaml
      - name: Check image formats extracted
        run: |
          images="${{ steps.giff.outputs.images }}"
          echo "Extracted: $images"
          echo ""
          check() { echo -n "  $1: "; echo "$images" | grep -q "$2" && echo "OK" || { echo "FAIL (not found)"; exit 1; }; }
          
          # Dockerfile-only refs
          check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1"
          check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaa"
          
          # K8s-only refs
          check "K8s registry+tag (app:v2)" "example.com/library/app:v2"
          check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbb"
          
          # Shared ref (in both files) — must appear exactly once
          check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot"
          count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true)
          echo -n "  Shared ref appears once (no duplicates): "
          [ "$count" -eq 1 ] && echo "OK (count=$count)" || { echo "FAIL (count=$count, expected 1)"; exit 1; }
          total=$(echo "$images" | tr ',' '\n' | grep -c . || true)
          echo -n "  Total unique refs: "
          [ "$total" -eq 5 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 5)"; exit 1; }
          
          echo ""
          echo "All checks passed."