refactor(get-images-from-files): to return json array (#31)

Working with a proper JSON array is way better than the comma separated list, as the JSON array can be directly fed into subsequent GitHub actions, without re-formatting.

Changes don't need to be treated as breaking, as there is no productive consumer yet.

Reviewed-on: t.behrendt/trivy-actions#31
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>

get-images-from-files/README.md

@@ -61,4 +61,4 @@ jobs:
 
 | Output    | Description                               |
 | --------- | ----------------------------------------- |
-| `images`  | Comma separated list of extracted image references. Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted. |
+| `images`  | JSON array of extracted image reference strings (e.g. `["docker.io/library/alpine:latest","gcr.io/distroless/static:nonroot@sha256:..."]`). Only fully-qualified refs (with registry) are included; short refs like `alpine:latest` are omitted. Parse with `jq` (e.g. `jq -r '.[]'`) to iterate. |

get-images-from-files/action.yaml

@@ -12,8 +12,8 @@ inputs:
 
 outputs:
   images:
-    description: "Comma-separated list of extracted image references (e.g. docker.io/library/alpine:latest,gcr.io/distroless/static:nonroot@sha256:...)"
-    value: ${{ steps.extract.outputs.images }}
+    description: "JSON array of extracted image reference strings (e.g. [\"docker.io/library/alpine:latest\",\"gcr.io/distroless/static:nonroot@sha256:...\"])"
+    value: ${{ steps.format.outputs.images }}
 
 runs:
   using: "composite"
@@ -45,4 +45,26 @@ runs:
             ' "$f" 2>/dev/null || true
           done | grep -E '/' | sort -u | paste -sd,
         )
-        echo "images=${images:-}" >> "$GITHUB_OUTPUT"
+        echo "images_list=${images:-}" >> "$GITHUB_OUTPUT"
+    - id: format
+      shell: bash
+      run: |
+        set -e
+        list="${{ steps.extract.outputs.images_list }}"
+        json_escape() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'; }
+        images="["
+        first=1
+        if [ -n "$list" ]; then
+          IFS=,
+          for img in $list; do
+            [ -z "$img" ] && continue
+            [ "$first" -eq 1 ] && first=0 || images+=","
+            images+="\"$(json_escape "$img")\""
+          done
+        fi
+        images+="]"
+        echo "images=${images}" >> "$GITHUB_OUTPUT"
+    - id: list-images
+      shell: bash
+      run: |
+        echo '${{ steps.format.outputs.images }}'