feat(get-images-from-files): add support for helm values (#29)

Adding support for images inside of helm value files as per helm convention.
Limitation: Default images the chart may propose are not exposed and therefore not supported, only what's specifically mentioned in the values file.

Reviewed-on: t.behrendt/trivy-actions#29
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: t.behrendt <t.behrendt@t00n.de>
Co-committed-by: t.behrendt <t.behrendt@t00n.de>

get-images-from-files/README.md

@@ -1,11 +1,20 @@
 # Get Images From Files Action
 
-A reusable Gitea Action, that extracts docker images from selected files in a repository.
-
-The action supports Dockerfiles, Kubernetes manifests, and Docker Compose/compose files. Other files are supported if they have a recognizable image reference. Duplicate image references are deduplicated.
+A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated.
 
 **Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged.
 
+## Supported file formats
+
+| Format | How images are extracted |
+| ------ | ------------------------- |
+| **Dockerfile** | `FROM` lines; the image ref is the last token (handles `FROM --platform=... <image>`). |
+| **Kubernetes manifests** | Lines with `image:` (e.g. under `containers` / `initContainers`); the value is taken as the image ref. |
+| **Docker Compose / Compose** | Same as Kubernetes: `image:` key under services. |
+| **Helmfile values** | Pairs of `repository` and `tag` (both required) at the same indent; ref is `repository:tag`. A lone `tag` without `repository` is skipped. |
+
+Other files are supported if they use one of these patterns (e.g. `image:` or `FROM`).
+
 ## Usage
 
 ### Basic Usage

get-images-from-files/action.yaml

@@ -1,5 +1,5 @@
 name: "Get Images From Files"
-description: "Extract docker images from selected files (Dockerfiles, Kubernetes manifests, Docker Compose/compose files, and files with recognizable image references)"
+description: "Extract docker images from selected files (Dockerfiles, Kubernetes manifests, Docker Compose/compose files, Helmfile values, and files with recognizable image references)"
 author: "Timo Behrendt <t.behrendt@t00n.de>"
 branding:
   icon: "package"
@@ -32,6 +32,17 @@ runs:
             awk '/^[[:space:]]*FROM[[:space:]]/ { print $NF }' "$f" 2>/dev/null || true
             # Kubernetes / Docker Compose: image: <ref>
             grep -E '[[:space:]]image:[[:space:]]' "$f" 2>/dev/null | sed 's/.*image:[[:space:]]*//' | awk '{ print $1 }' || true
+            # Helmfile values: repository + tag (both required, by indent); tag without repo is skipped
+            awk '
+              match($0, /^[[:space:]]*/) { indent = RLENGTH }
+              /^[[:space:]]*repository:[[:space:]]/ {
+                v = $0; sub(/^[^:]*:[[:space:]]*"?/, "", v); sub(/"?[[:space:]]*$/, "", v); repo[indent] = v; next
+              }
+              /^[[:space:]]*tag:[[:space:]]/ {
+                v = $0; sub(/^[^:]*:[[:space:]]*"?/, "", v); sub(/"?[[:space:]]*$/, "", v);
+                if (repo[indent] != "") { print repo[indent] ":" v; delete repo[indent] }; next
+              }
+            ' "$f" 2>/dev/null || true
           done | grep -E '/' | sort -u | paste -sd,
         )
         echo "images=${images:-}" >> "$GITHUB_OUTPUT"

get-images-from-files/test-values-helmfile.yaml

@@ -0,0 +1,16 @@
+# Used by CI to test get-images-from-files action (Helmfile values, fully-qualified refs only)
+# Simple convention: image.repository + image.tag
+image:
+  repository: example.com/helmfile/app
+  tag: "v4"
+
+# Nested under images (repository + tag)
+images:
+  worker:
+    repository: example.com/helmfile/worker
+    tag: "v5"
+  helper:
+    repository: example.com/myproject/helper
+    tag: "2.0@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+  invalid-references:
+    repository: example.com/helmfile/invalid-references