#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TARGET_IMAGE="${1:?usage: scan-ci-image.sh <image>}"
TRIVY_IMAGE="aquasec/trivy@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
SAFE_NAME="$(printf '%s' "$TARGET_IMAGE" | tr -cs 'A-Za-z0-9._-' '-')"
ARCHIVE_RELATIVE="artifacts/.${SAFE_NAME}.tar"
ARCHIVE="$ROOT/$ARCHIVE_RELATIVE"
trap 'rm -f "$ARCHIVE"' EXIT

mkdir -p "$ROOT/artifacts"
docker image inspect "$TARGET_IMAGE" >/dev/null
docker save --output "$ARCHIVE" "$TARGET_IMAGE"

WORKSPACE_ARGS=(-v "$ROOT:/workspace:ro")
CONTAINER_ARCHIVE="/workspace/$ARCHIVE_RELATIVE"
if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
  WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
  CONTAINER_ARCHIVE="$ROOT/$ARCHIVE_RELATIVE"
fi

docker run --rm "${WORKSPACE_ARGS[@]}" "$TRIVY_IMAGE" image \
  --input "$CONTAINER_ARCHIVE" \
  --scanners vuln \
  --severity HIGH,CRITICAL \
  --ignore-unfixed \
  --exit-code 1 \
  --format table