.gitea/workflows/ci.yaml

@@ -31,3 +31,42 @@ jobs:
         uses: ./setup-db
       - name: Run Trivy
         run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .
+
+  test-get-images-from-files:
+    name: Test Get Images From Files
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - id: giff
+        uses: ./get-images-from-files
+        with:
+          files: |
+            - get-images-from-files/test.Dockerfile
+            - get-images-from-files/test-deployment.yaml
+      - name: Check image formats extracted
+        run: |
+          images="${{ steps.giff.outputs.images }}"
+          echo "Extracted: $images"
+          echo ""
+          check() { echo -n "  $1: "; echo "$images" | grep -q "$2" && echo "OK" || { echo "FAIL (not found)"; exit 1; }; }
+          
+          # Dockerfile-only refs
+          check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1"
+          check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaa"
+          
+          # K8s-only refs
+          check "K8s registry+tag (app:v2)" "example.com/library/app:v2"
+          check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbb"
+          
+          # Shared ref (in both files) — must appear exactly once
+          check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot"
+          count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true)
+          echo -n "  Shared ref appears once (no duplicates): "
+          [ "$count" -eq 1 ] && echo "OK (count=$count)" || { echo "FAIL (count=$count, expected 1)"; exit 1; }
+          total=$(echo "$images" | tr ',' '\n' | grep -c . || true)
+          echo -n "  Total unique refs: "
+          [ "$total" -eq 5 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 5)"; exit 1; }
+          
+          echo ""
+          echo "All checks passed."

get-images-from-files/README.md

@@ -0,0 +1,53 @@
+# Get Images From Files Action
+
+A reusable Gitea Action, that extracts docker images from selected files in a repository.
+
+The action supports Dockerfiles and Kubernetes manifests. Other files are supported if they have a recognizable image reference. Duplicate image references are deduplicated.
+
+**Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged.
+
+## Usage
+
+### Basic Usage
+
+```yaml
+- name: Get Images From Files
+  uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
+  with:
+    files: |
+        - Dockerfile
+        - k8s/50_deployment.yaml
+        - values/traefik.yaml
+```
+
+### Complete Example
+
+```yaml
+name: Get Images From Files
+on: [push, pull_request]
+
+jobs:
+  get-images-from-files:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get Images From Files
+        uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1
+        with:
+            files: |
+              - Dockerfile
+              - k8s/50_deployment.yaml
+              - values/traefik.yaml
+```
+
+## Inputs
+
+| Input     | Description                               | Required | Default  |
+| --------- | ----------------------------------------- | -------- | -------- |
+| `files`   | Files to extract images from. Multiple files can be specified.. | Yes       |  |
+
+## Outputs
+
+| Output    | Description                               |
+| --------- | ----------------------------------------- |
+| `images`  | Comma separated list of extracted image references. Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted. |

get-images-from-files/action.yaml

@@ -0,0 +1,37 @@
+name: "Get Images From Files"
+description: "Extract docker images from selected files (Dockerfiles, Kubernetes manifests, and files with recognizable image references)"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "package"
+  color: "blue"
+
+inputs:
+  files:
+    description: "Files to extract images from. Multiple files can be specified (YAML list format)."
+    required: true
+
+outputs:
+  images:
+    description: "Comma-separated list of extracted image references (e.g. docker.io/library/alpine:latest,gcr.io/distroless/static:nonroot@sha256:...)"
+    value: ${{ steps.extract.outputs.images }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: extract
+      shell: bash
+      run: |
+        set -e
+        files="${{ inputs.files }}"
+        # Parse YAML list: lines like "  - path/to/file" or "- file"
+        file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'")
+        images=$(
+          for f in $file_list; do
+            [ -f "$f" ] || continue
+            # Dockerfile: FROM [--platform=...] <image>
+            awk '/^[[:space:]]*FROM[[:space:]]/ { print $NF }' "$f" 2>/dev/null || true
+            # Kubernetes / Compose: image: <ref>
+            grep -E '[[:space:]]image:[[:space:]]' "$f" 2>/dev/null | sed 's/.*image:[[:space:]]*//' | awk '{ print $1 }' || true
+          done | grep -E '/' | sort -u | paste -sd,
+        )
+        echo "images=${images:-}" >> "$GITHUB_OUTPUT"

get-images-from-files/test-deployment.yaml

@@ -0,0 +1,19 @@
+# Used by CI to test get-images-from-files action (K8s, distinct from Dockerfile)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test
+spec:
+  replicas: 1
+  template:
+    spec:
+      containers:
+        - name: app
+          # Registry with tag (K8s)
+          image: example.com/library/app:v2
+        - name: shared
+          # Same ref as in test.Dockerfile — tests deduplication
+          image: example.com/distroless/static:nonroot
+        - name: by-digest
+          # Registry with digest (K8s)
+          image: example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb

get-images-from-files/test.Dockerfile

@@ -0,0 +1,13 @@
+# Used by CI to test get-images-from-files action (registry refs only, distinct from K8s)
+# Registry with tag (Dockerfile)
+FROM example.com/library/nginx:v1
+# Registry path with tag — shared with K8s to test deduplication
+FROM example.com/distroless/static:nonroot
+# Registry with digest (Dockerfile)
+FROM example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+
+# Ignored tags
+## Short repo:tag (ignored by design; only registry refs are extracted)
+FROM nginx:3.19
+## With digest only but no registry (ignored)
+FROM nginx@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef