.gitea/workflows/ci.yaml

@@ -31,3 +31,31 @@ jobs:
         uses: ./setup-db
       - name: Run Trivy
         run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .
+
+  test-get-images-from-files:
+    name: Test Get Images From Files
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Get Images From Files
+        id: giff
+        uses: ./get-images-from-files
+        with:
+          files: |
+            - get-images-from-files/test.Dockerfile
+            - get-images-from-files/test-deployment.yaml
+      - name: Check image formats extracted
+        run: |
+          images="${{ steps.giff.outputs.images }}"
+          echo "Extracted: $images"
+          # Registry with tag
+          echo "$images" | grep -q 'example.com/library/nginx:latest'
+          echo "$images" | grep -q 'example.com/library/redis:7-alpine'
+          echo "$images" | grep -q 'example.com/library/app:1.25-alpine'
+          # Registry path with tag
+          echo "$images" | grep -q 'example.com/distroless/static:nonroot'
+          # Registry with digest
+          echo "$images" | grep -q 'example.com/distroless/static@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd'
+          echo "$images" | grep -q 'example.com/library/alpine@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef'
+          echo "$images" | grep -q 'example.com/myproject/myimg@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd'

get-images-from-files/README.md

@@ -0,0 +1,51 @@
+# Get Images From Files Action
+
+A reusable Gitea Action, that extracts docker images from selected files in a repository.
+
+The action supports Dockerfiles and Kubernetes manifests. Other files are supported if they have a recognizable image reference.
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Get Images From Files
+  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
+  with:
+    files: |
+        - Dockerfile
+        - k8s/50_deployment.yaml
+        - values/traefik.yaml
+```
+
+### Complete Example
+
+```yaml
+name: Get Images From Files
+on: [push, pull_request]
+
+jobs:
+  get-images-from-files:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get Images From Files
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
+        with:
+            files: |
+              - Dockerfile
+              - k8s/50_deployment.yaml
+              - values/traefik.yaml
+```
+
+## Inputs
+
+| Input     | Description                               | Required | Default  |
+| --------- | ----------------------------------------- | -------- | -------- |
+| `files`   | Files to extract images from. Multiple files can be specified.. | Yes       |  |
+
+## Outputs
+
+| Output    | Description                               |
+| --------- | ----------------------------------------- |
+| `images`  | Comma separated list of extracted image references. Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted. |

get-images-from-files/action.yaml

@@ -0,0 +1,37 @@
+name: "Get Images From Files"
+description: "Extract docker images from selected files (Dockerfiles, Kubernetes manifests, and files with recognizable image references)"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "package"
+  color: "blue"
+
+inputs:
+  files:
+    description: "Files to extract images from. Multiple files can be specified (YAML list format)."
+    required: true
+
+outputs:
+  images:
+    description: "Comma-separated list of extracted image references (e.g. docker.io/library/alpine:latest,gcr.io/distroless/static:nonroot@sha256:...)"
+    value: ${{ steps.extract.outputs.images }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: extract
+      shell: bash
+      run: |
+        set -e
+        files="${{ inputs.files }}"
+        # Parse YAML list: lines like "  - path/to/file" or "- file"
+        file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'")
+        images=$(
+          for f in $file_list; do
+            [ -f "$f" ] || continue
+            # Dockerfile: FROM [--platform=...] <image>
+            awk '/^[[:space:]]*FROM[[:space:]]/ { print $NF }' "$f" 2>/dev/null || true
+            # Kubernetes / Compose: image: <ref>
+            grep -E '[[:space:]]image:[[:space:]]' "$f" 2>/dev/null | sed 's/.*image:[[:space:]]*//' | awk '{ print $1 }' || true
+          done | grep -E '/' | sort -u | paste -sd,
+        )
+        echo "images=${images:-}" >> "$GITHUB_OUTPUT"

get-images-from-files/test-deployment.yaml

@@ -0,0 +1,20 @@
+# Used by CI to test get-images-from-files action (K8s manifest, registry refs only)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: app
+          image: example.com/library/app:1.25-alpine
+        - name: sidecar
+          image: example.com/library/redis:7-alpine
+        - name: distroless
+          image: example.com/distroless/static:nonroot
+        - name: by-digest
+          image: example.com/library/alpine@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+        - name: fqdn-digest
+          image: example.com/myproject/myimg@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd

get-images-from-files/test.Dockerfile

@@ -0,0 +1,11 @@
+# Used by CI to test get-images-from-files action (varied image formats, registry refs only)
+# Short repo:tag (ignored by design; only registry refs are extracted)
+FROM nginx:3.19
+# Fully qualified with host and tag
+FROM example.com/library/nginx:latest
+# Registry path with tag
+FROM example.com/distroless/static:nonroot
+# With digest only but no registry (ignored)
+FROM nginx@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef
+# Fully qualified with digest
+FROM example.com/distroless/static@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd