cve-differential/.gitea/workflows/test.yaml

name: CI Tests

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

jobs:
  test:
    name: ${{ matrix.image_set.name }} (sbom=${{ matrix.use_inbuild_sbom }})
    runs-on: k8s
    strategy:
      fail-fast: false
      matrix:
        image_set:
          # Test 1: Slim images with built-in SBOMs (2 architectures, 15-40 CVEs each)
          - name: with-inbuild-sbom
            head_image: debian:bookworm-slim
            target_image: debian:bullseye-slim
            architectures: amd64,arm64
            expect_arch_col: true

          # Test 2: Slim images without built-in SBOMs (1 architecture, 70-120 CVEs each)
          - name: without-inbuild-sbom
            head_image: debian:buster-slim
            target_image: debian:stretch-slim
            architectures: amd64
            expect_arch_col: false

          # Test 3: Cross-check (Head has built-in SBOM, Target does not, 15-70 CVEs each)
          - name: cross-check-mixed-sbom
            head_image: debian:bookworm-slim
            target_image: debian:buster-slim
            architectures: amd64
            expect_arch_col: false

        use_inbuild_sbom:
          - "true"
          - "false"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Test CVE Differential Action
        uses: ./
        with:
          head-image: ${{ matrix.image_set.head_image }}
          target-image: ${{ matrix.image_set.target_image }}
          target-branch: main
          architectures: ${{ matrix.image_set.architectures }}
          use-inbuild-sbom: ${{ matrix.use_inbuild_sbom }}
          output-delta: cve-delta.md
          output-summary: cve-summary.md

      - name: Verify Report Generation & Content
        shell: bash
        run: |
          set -euo pipefail

          test -s cve-delta.md || (echo "::error::cve-delta.md is empty or missing" && exit 1)
          test -s cve-summary.md || (echo "::error::cve-summary.md is empty or missing" && exit 1)

          # Verify that each scan produced at least 3 CVE findings
          cve_count=$(grep -c "CVE-" cve-summary.md || echo 0)
          echo "Total CVE entries found in summary report: $cve_count"
          if [ "$cve_count" -lt 3 ]; then
            echo "::error::Expected at least 3 CVEs in cve-summary.md, found only $cve_count"
            exit 1
          fi

          echo "=== Delta Report Preview ==="
          head -n 25 cve-delta.md

          # Verify architectural column rendering behavior
          if [ "${{ matrix.image_set.expect_arch_col }}" = "true" ]; then
            grep -q "| Arch |" cve-delta.md || (echo "::error::Expected Arch column in multi-arch report" && exit 1)
          else
            if grep -q "| Arch |" cve-delta.md; then
              echo "::error::Did not expect Arch column in single-arch report" && exit 1
            fi
          fi
          echo "✅ All assertions passed (including >= 3 CVEs verification)."