feat: add get-images-from-files action (#27)

Reviewed-on: t.behrendt/trivy-actions#27
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: t.behrendt <t.behrendt@t00n.de>
Co-committed-by: t.behrendt <t.behrendt@t00n.de>

get-images-from-files/README.md

@@ -0,0 +1,53 @@
+# Get Images From Files Action
+
+A reusable Gitea Action, that extracts docker images from selected files in a repository.
+
+The action supports Dockerfiles and Kubernetes manifests. Other files are supported if they have a recognizable image reference. Duplicate image references are deduplicated.
+
+**Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged.
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Get Images From Files
+  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
+  with:
+    files: |
+        - Dockerfile
+        - k8s/50_deployment.yaml
+        - values/traefik.yaml
+```
+
+### Complete Example
+
+```yaml
+name: Get Images From Files
+on: [push, pull_request]
+
+jobs:
+  get-images-from-files:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get Images From Files
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
+        with:
+            files: |
+              - Dockerfile
+              - k8s/50_deployment.yaml
+              - values/traefik.yaml
+```
+
+## Inputs
+
+| Input     | Description                               | Required | Default  |
+| --------- | ----------------------------------------- | -------- | -------- |
+| `files`   | Files to extract images from. Multiple files can be specified.. | Yes       |  |
+
+## Outputs
+
+| Output    | Description                               |
+| --------- | ----------------------------------------- |
+| `images`  | Comma separated list of extracted image references. Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted. |

get-images-from-files/action.yaml

@@ -0,0 +1,37 @@
+name: "Get Images From Files"
+description: "Extract docker images from selected files (Dockerfiles, Kubernetes manifests, and files with recognizable image references)"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "package"
+  color: "blue"
+
+inputs:
+  files:
+    description: "Files to extract images from. Multiple files can be specified (YAML list format)."
+    required: true
+
+outputs:
+  images:
+    description: "Comma-separated list of extracted image references (e.g. docker.io/library/alpine:latest,gcr.io/distroless/static:nonroot@sha256:...)"
+    value: ${{ steps.extract.outputs.images }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: extract
+      shell: bash
+      run: |
+        set -e
+        files="${{ inputs.files }}"
+        # Parse YAML list: lines like "  - path/to/file" or "- file"
+        file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'")
+        images=$(
+          for f in $file_list; do
+            [ -f "$f" ] || continue
+            # Dockerfile: FROM [--platform=...] <image>
+            awk '/^[[:space:]]*FROM[[:space:]]/ { print $NF }' "$f" 2>/dev/null || true
+            # Kubernetes / Compose: image: <ref>
+            grep -E '[[:space:]]image:[[:space:]]' "$f" 2>/dev/null | sed 's/.*image:[[:space:]]*//' | awk '{ print $1 }' || true
+          done | grep -E '/' | sort -u | paste -sd,
+        )
+        echo "images=${images:-}" >> "$GITHUB_OUTPUT"

get-images-from-files/test-deployment.yaml

@@ -0,0 +1,19 @@
+# Used by CI to test get-images-from-files action (K8s, distinct from Dockerfile)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: app
+          # Registry with tag (K8s)
+          image: example.com/library/app:v2
+        - name: shared
+          # Same ref as in test.Dockerfile — tests deduplication
+          image: example.com/distroless/static:nonroot
+        - name: by-digest
+          # Registry with digest (K8s)
+          image: example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb

get-images-from-files/test.Dockerfile

@@ -0,0 +1,13 @@
+# Used by CI to test get-images-from-files action (registry refs only, distinct from K8s)
+# Registry with tag (Dockerfile)
+FROM example.com/library/nginx:v1
+# Registry path with tag — shared with K8s to test deduplication
+FROM example.com/distroless/static:nonroot
+# Registry with digest (Dockerfile)
+FROM example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+
+# Ignored tags
+## Short repo:tag (ignored by design; only registry refs are extracted)
+FROM nginx:3.19
+## With digest only but no registry (ignored)
+FROM nginx@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef