refactor(get-images-from-files): to return json array (#31)

Working with a proper JSON array is way better than the comma separated list, as the JSON array can be directly fed into subsequent GitHub actions, without re-formatting.

Changes don't need to be treated as breaking, as there is no productive consumer yet.

Reviewed-on: t.behrendt/trivy-actions#31
Reviewed-by: branch-buddy <branch-buddy@t00n.de>
Co-authored-by: Timo Behrendt <t.behrendt@t00n.de>
Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>

.gitea/workflows/ci.yaml

@@ -48,18 +48,19 @@ jobs:
             - get-images-from-files/test-values-helmfile.yaml
       - name: Check image formats extracted
         run: |
-          images="${{ steps.giff.outputs.images }}"
+          images='${{ steps.giff.outputs.images }}'
-          echo "Extracted: $images"
+          echo "JSON array (for manual inspection):"
+          echo "$images" | jq .
           echo ""
-          check() { echo -n "  $1: "; echo "$images" | grep -q "$2" && echo "OK" || { echo "FAIL (not found)"; exit 1; }; }
+          check() { echo -n "  $1: "; echo "$images" | jq -e --arg ref "$2" 'index($ref) != null' >/dev/null && echo "OK" || { echo "FAIL (not found)"; exit 1; }; }
           
           # Dockerfile-only refs
           check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1"
-          check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaa"
+          check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
           
           # K8s-only refs
           check "K8s registry+tag (app:v2)" "example.com/library/app:v2"
-          check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbb"
+          check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
           
           # Compose-only refs
           check "Compose registry+tag (web:v3)" "example.com/compose/web:v3"
@@ -68,14 +69,14 @@ jobs:
           # Helmfile values (repository + tag, optional registry)
           check "Helmfile image (repository+tag)" "example.com/helmfile/app:v4"
           check "Helmfile images.worker (repository+tag)" "example.com/helmfile/worker:v5"
-          check "Helmfile images.helper (repository+tag with digest)" "example.com/myproject/helper:2.0@sha256:cccc"
+          check "Helmfile images.helper (repository+tag with digest)" "example.com/myproject/helper:2.0@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
           
           # Shared ref (in both files) — must appear exactly once
           check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot"
-          count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true)
+          count=$(echo "$images" | jq '[.[] | select(. == "example.com/distroless/static:nonroot")] | length')
           echo -n "  Shared ref appears once (no duplicates): "
           [ "$count" -eq 1 ] && echo "OK (count=$count)" || { echo "FAIL (count=$count, expected 1)"; exit 1; }
-          total=$(echo "$images" | tr ',' '\n' | grep -c . || true)
+          total=$(echo "$images" | jq 'length')
           echo -n "  Total unique refs: "
           [ "$total" -eq 10 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 10)"; exit 1; }
           

get-images-from-files/README.md

@@ -61,4 +61,4 @@ jobs:
 
 | Output    | Description                               |
 | --------- | ----------------------------------------- |
-| `images`  | Comma separated list of extracted image references. Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted. |
+| `images`  | JSON array of extracted image reference strings (e.g. `["docker.io/library/alpine:latest","gcr.io/distroless/static:nonroot@sha256:..."]`). Only fully-qualified refs (with registry) are included; short refs like `alpine:latest` are omitted. Parse with `jq` (e.g. `jq -r '.[]'`) to iterate. |

get-images-from-files/action.yaml

@@ -12,8 +12,8 @@ inputs:
 
 outputs:
   images:
-    description: "Comma-separated list of extracted image references (e.g. docker.io/library/alpine:latest,gcr.io/distroless/static:nonroot@sha256:...)"
+    description: "JSON array of extracted image reference strings (e.g. [\"docker.io/library/alpine:latest\",\"gcr.io/distroless/static:nonroot@sha256:...\"])"
-    value: ${{ steps.extract.outputs.images }}
+    value: ${{ steps.format.outputs.images }}
 
 runs:
   using: "composite"
@@ -45,4 +45,26 @@ runs:
             ' "$f" 2>/dev/null || true
           done | grep -E '/' | sort -u | paste -sd,
         )
-        echo "images=${images:-}" >> "$GITHUB_OUTPUT"
+        echo "images_list=${images:-}" >> "$GITHUB_OUTPUT"
+    - id: format
+      shell: bash
+      run: |
+        set -e
+        list="${{ steps.extract.outputs.images_list }}"
+        json_escape() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g'; }
+        images="["
+        first=1
+        if [ -n "$list" ]; then
+          IFS=,
+          for img in $list; do
+            [ -z "$img" ] && continue
+            [ "$first" -eq 1 ] && first=0 || images+=","
+            images+="\"$(json_escape "$img")\""
+          done
+        fi
+        images+="]"
+        echo "images=${images}" >> "$GITHUB_OUTPUT"
+    - id: list-images
+      shell: bash
+      run: |
+        echo '${{ steps.format.outputs.images }}'