#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TARGET_IMAGE="${1:-geointel-ci:local}"
OUTPUT="${2:-artifacts/geointel-container-vulnerabilities.json}"
TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
CACHE_VOLUME="${GEOINTEL_TRIVY_CACHE_VOLUME:-geointel-trivy-cache}"
PYTHON_CMD="${PYTHON_BIN:-python3}"
IGNORE_FILE="$(mktemp)"
CONTAINER_IGNORE_FILE="/tmp/geointel-trivy-ignore.txt"
POLICY_CONTAINER=""

cleanup() {
  rm -f "$IGNORE_FILE"
  if [ -n "$POLICY_CONTAINER" ]; then
    docker rm -f "$POLICY_CONTAINER" >/dev/null 2>&1 || true
  fi
}
trap cleanup EXIT

case "$OUTPUT" in
  /*|*..*)
    echo "Scan output must be a repository-relative path without '..'." >&2
    exit 1
    ;;
esac

docker image inspect "$TARGET_IMAGE" >/dev/null
mkdir -p "$ROOT/$(dirname "$OUTPUT")"
"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py"
"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
  --print-container-ids > "$IGNORE_FILE"

docker volume create "$CACHE_VOLUME" >/dev/null

# Keep the complete report, including vulnerabilities without an available fix.
# Stream JSON over stdout so no checkout path has to be mounted through the
# nested Gitea/act container boundary.
docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v "$CACHE_VOLUME:/root/.cache/trivy" \
  "$TRIVY_IMAGE" \
  image \
  --scanners vuln \
  --timeout 20m \
  --skip-version-check \
  --format json \
  "$TARGET_IMAGE" > "$ROOT/$OUTPUT"

# Release policy: fixed HIGH/CRITICAL findings block the build. Unfixed findings
# remain visible in the full report and must be reviewed before release. Copy
# the verified exception IDs into a stopped scanner container before starting
# it; `docker cp` works when the job checkout itself lives in another container.
POLICY_CONTAINER="$(docker create \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v "$CACHE_VOLUME:/root/.cache/trivy" \
  "$TRIVY_IMAGE" \
  image \
  --scanners vuln \
  --timeout 20m \
  --skip-version-check \
  --ignore-unfixed \
  --ignorefile "$CONTAINER_IGNORE_FILE" \
  --skip-files /usr/local/bin/gosu \
  --severity HIGH,CRITICAL \
  --exit-code 1 \
  "$TARGET_IMAGE")"
docker cp "$IGNORE_FILE" "$POLICY_CONTAINER:$CONTAINER_IGNORE_FILE"
docker start -a "$POLICY_CONTAINER"
docker rm "$POLICY_CONTAINER" >/dev/null
POLICY_CONTAINER=""

test -s "$ROOT/$OUTPUT"
echo "Container vulnerability report written to $OUTPUT"