#!/usr/bin/env bash
# Scan a locally built image for known vulnerabilities with Trivy.
#
# Usage: scripts/ci/scan_image.sh <image-ref>
#
# Fails (exit 1) on HIGH or CRITICAL findings that have a fixed version. Findings
# without a fix are reported by Trivy but do not fail the scan (nothing can be done
# about them yet). Accepted findings are listed in security/trivyignore.txt, one
# vulnerability id per line with a reason, and in docs/security.md. The image is
# exported with `docker save` so Trivy needs no access to the Docker socket.
#
# Trivy itself is pinned (scripts/ci/install_trivy.sh); its vulnerability database
# is fetched fresh on every run, which is the point of scanning.
set -euo pipefail

image="${1:?usage: scan_image.sh <image-ref>}"
ignore_file="security/trivyignore.txt"

work="$(mktemp -d)"
trap 'rm -rf "${work}"' EXIT

docker save --output "${work}/image.tar" "${image}"

args=(
  image
  --input "${work}/image.tar"
  --cache-dir "${work}/cache"
  --scanners vuln
  --severity HIGH,CRITICAL
  --ignore-unfixed
  --exit-code 1
  --no-progress
  --db-repository "ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2"
)
if [ -f "${ignore_file}" ]; then
  args+=(--ignorefile "${ignore_file}")
fi

trivy "${args[@]}"