name: CI

on:
  pull_request:

jobs:
  test-setup-trivy:
    strategy:
      matrix:
        arch: [amd64, arm64]
    name: Test Setup Trivy ${{ matrix.arch }}
    runs-on:
      - ubuntu-latest
      - linux_${{ matrix.arch }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Setup Trivy
        uses: ./setup-trivy
      - name: Run Trivy
        run: trivy --version

  test-setup-db:
    name: Test Setup DB
    runs-on:
      - ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: ./setup-trivy
      - name: Setup DB
        id: setup-db
        uses: ./setup-db
      - name: Run Trivy
        run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .

  test-get-images-from-files:
    name: Test Get Images From Files
    runs-on:
      - ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - id: giff
        uses: ./get-images-from-files
        with:
          files: |
            - get-images-from-files/test.Dockerfile
            - get-images-from-files/test-deployment.yaml
      - name: Check image formats extracted
        run: |
          images="${{ steps.giff.outputs.images }}"
          echo "Extracted: $images"
          # Dockerfile-only: registry with tag, registry with digest
          echo "$images" | grep -q 'example.com/library/nginx:v1'
          echo "$images" | grep -q 'example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
          # K8s-only: registry with tag, registry with digest
          echo "$images" | grep -q 'example.com/library/app:v2'
          echo "$images" | grep -q 'example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'
          # Shared ref (in both Dockerfile and K8s) — must appear exactly once
          echo "$images" | grep -q 'example.com/distroless/static:nonroot'
          count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true)
          [ "$count" -eq 1 ] || { echo "expected shared ref once, got: $count"; exit 1; }
          # Total unique refs: 5
          total=$(echo "$images" | tr ',' '\n' | grep -c . || true)
          [ "$total" -eq 5 ] || { echo "expected 5 unique refs, got: $total"; exit 1; }