sec-actions/.gitea/workflows/ci.yaml

name: CI

on:
  pull_request:

jobs:
  test-setup-osv:
    strategy:
      matrix:
        arch: [amd64, arm64]
    name: Test Setup OSV Scanner ${{ matrix.arch }}
    runs-on:
      - ubuntu-latest
      - linux_${{ matrix.arch }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Setup OSV Scanner
        uses: ./setup-osv
        with:
          version: v2.4.0
          amd64-digest: 15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0
          arm64-digest: 44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9
      - name: Run osv-scanner
        run: osv-scanner --version

  test-setup-db:
    name: Test Setup DB
    runs-on:
      - ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: ./setup-osv
        with:
          version: v2.4.0
          amd64-digest: 15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0
          arm64-digest: 44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9
      - name: Setup DB
        id: setup-db
        uses: ./setup-db
        with:
          # Keep CI fast; full ecosystem download is covered by the action default.
          ecosystems: Go,npm,PyPI
      - name: Run osv-scanner offline
        run: |
          test -n "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}"
          test "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}" = "${{ steps.setup-db.outputs.cache-dir }}"
          test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/Go/all.zip"
          test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/npm/all.zip"
          test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/PyPI/all.zip"
          osv-scanner scan source --offline-vulnerabilities --allow-no-lockfiles .

  test-get-images-from-files:
    name: Test Get Images From Files
    runs-on:
      - ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - id: giff
        uses: ./get-images-from-files
        with:
          files: |
            - get-images-from-files/test.Dockerfile
            - get-images-from-files/test-deployment.yaml
            - get-images-from-files/test-compose.yaml
            - get-images-from-files/test-values-helmfile.yaml
      - name: Check image formats extracted
        run: |
          images='${{ steps.giff.outputs.images }}'
          echo "JSON array (for manual inspection):"
          echo "$images" | jq .
          echo ""
          check() { echo -n "  $1: "; echo "$images" | jq -e --arg ref "$2" 'index($ref) != null' >/dev/null && echo "OK" || { echo "FAIL (not found)"; exit 1; }; }

          # Dockerfile-only refs
          check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1"
          check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"

          # K8s-only refs
          check "K8s registry+tag (app:v2)" "example.com/library/app:v2"
          check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"

          # Compose-only refs
          check "Compose registry+tag (web:v3)" "example.com/compose/web:v3"
          check "Compose registry+tag (worker:v3)" "example.com/compose/worker:v3"

          # Helmfile values (repository + tag, optional registry)
          check "Helmfile image (repository+tag)" "example.com/helmfile/app:v4"
          check "Helmfile images.worker (repository+tag)" "example.com/helmfile/worker:v5"
          check "Helmfile images.helper (repository+tag with digest)" "example.com/myproject/helper:2.0@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"

          # Shared ref (in both files) — must appear exactly once
          check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot"
          count=$(echo "$images" | jq '[.[] | select(. == "example.com/distroless/static:nonroot")] | length')
          echo -n "  Shared ref appears once (no duplicates): "
          [ "$count" -eq 1 ] && echo "OK (count=$count)" || { echo "FAIL (count=$count, expected 1)"; exit 1; }
          total=$(echo "$images" | jq 'length')
          echo -n "  Total unique refs: "
          [ "$total" -eq 10 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 10)"; exit 1; }

          echo ""
          echo "All checks passed."

  test-merge-sarif-files:
    name: Test Merge SARIF Files
    runs-on:
      - ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - name: Merge SARIF Files
        uses: ./merge-sarif-files
        with:
          files: |
            - merge-sarif-files/test_sarif1.json
            - merge-sarif-files/test_sarif2.json
          output-file: merged.sarif
      - name: Check merged SARIF file
        run: |
          # Structure: version, schema, 2 runs
          run_count=$(jq '.runs | length' merged.sarif)
          [ "$run_count" -eq 2 ] || { echo "FAIL: expected 2 runs, got $run_count"; exit 1; }
          echo "Merged SARIF has $run_count runs."
          jq -e '.version and .["$schema"] and (.runs | length > 0)' merged.sarif >/dev/null || { echo "FAIL: invalid SARIF structure"; exit 1; }

          # Content: results from test_sarif1.json (ruleId KSV-0014) and test_sarif2.json (ruleId CVE-2026-26019) must be present
          rule_ids=$(jq -r '[.runs[].results[].ruleId] | unique[]' merged.sarif)
          echo "$rule_ids" | grep -q 'KSV-0014' || { echo "FAIL: merged file missing result from test_sarif1.json (ruleId KSV-0014)"; exit 1; }
          echo "$rule_ids" | grep -q 'CVE-2026-26019' || { echo "FAIL: merged file missing result from test_sarif2.json (ruleId CVE-2026-26019)"; exit 1; }
          echo "Merged results contain ruleIds from both input files."
          echo "All checks passed."