name: Trivy Scan
description: >
  Scan an image in registry.noctrl.eu for vulnerabilities and fail on findings.
  Pulls the image directly from the registry — no podman storage involved.
  Pin the calling job to an amd64 runner (never arm); vulnerability results are
  package-based and arch-independent, so scanning a multi-arch ref once
  (trivy picks the host platform's variant) covers all variants.

inputs:
  image-name:
    description: Repository/image name path, for example noctrl/gitea-runner
    required: true
  tag:
    description: Tag to scan, for example sha-abc123 or sha-abc123-amd64
    required: true
  severity:
    description: Comma-separated Trivy severities that fail the scan.
    required: false
    default: HIGH,CRITICAL
  registry-username:
    description: Registry username for pulling the image.
    required: true
  registry-password:
    description: Registry password for pulling the image.
    required: true

runs:
  using: composite
  steps:
    - id: scan
      shell: bash
      env:
        TRIVY_USERNAME: ${{ inputs.registry-username }}
        TRIVY_PASSWORD: ${{ inputs.registry-password }}
      run: |
        set -euo pipefail

        if ! command -v trivy >/dev/null 2>&1; then
          echo "ERROR: trivy not found on this runner (needs noctrl/gitea-runner >= v9)" >&2
          exit 1
        fi

        image_ref="registry.noctrl.eu/${{ inputs.image-name }}:${{ inputs.tag }}"

        # --ignore-unfixed: unfixed base-image CVEs are unactionable and would
        # perma-block builds; the gate is on vulnerabilities with a fix.
        echo "Scanning ${image_ref} (fail on: ${{ inputs.severity }}, fixed only)"
        trivy image \
          --scanners vuln \
          --severity "${{ inputs.severity }}" \
          --ignore-unfixed \
          --exit-code 1 \
          --no-progress \
          "${image_ref}"