cve-differential/.gitea/workflows/test.yaml

name: CI Tests

on:
  push:
    branches:
    - main
  pull_request:
    branches:
    - main
  workflow_dispatch:

jobs:
  unit-test:
    name: JS Unit Tests
    runs-on: k8s
    steps:
    - name: Checkout repository
      uses: actions/checkout@v7

    - name: Run JS Unit Tests
      shell: bash
      run: node --test

  test:
    name: ${{ matrix.image_set.name }} (sbom=${{ matrix.use_inbuild_sbom }})
    needs: unit-test
    runs-on: k8s
    strategy:
      fail-fast: false
      matrix:
        image_set:
          # Test 1: Slim images with built-in SBOMs (2 architectures, 15-40 CVEs each)
        - name: with-inbuild-sbom
          head_image: debian:bookworm-slim
          target_image: debian:bullseye-slim
          architectures: amd64,arm64
          expect_arch_col: true

          # Test 2: Slim images without built-in SBOMs (1 architecture, 70-120 CVEs each)
        - name: without-inbuild-sbom
          head_image: debian:buster-slim
          target_image: debian:stretch-slim
          architectures: amd64
          expect_arch_col: false

          # Test 3: Cross-check (Head has built-in SBOM, Target does not, 15-70 CVEs each)
        - name: cross-check-mixed-sbom
          head_image: debian:bookworm-slim
          target_image: debian:buster-slim
          architectures: amd64
          expect_arch_col: false

        use_inbuild_sbom:
        - 'true'
        - 'false'

    steps:
    - name: Checkout repository
      uses: actions/checkout@v7

    - name: Test CVE Differential Action
      uses: ./
      with:
        head-image: ${{ matrix.image_set.head_image }}
        target-image: ${{ matrix.image_set.target_image }}
        target-branch: main
        architectures: ${{ matrix.image_set.architectures }}
        use-inbuild-sbom: ${{ matrix.use_inbuild_sbom }}
        output-delta: cve-delta.md
        output-summary: cve-summary.md

    - name: Verify Report Generation & Content
      shell: bash
      run: |
        set -euo pipefail

        test -s cve-delta.md || (echo "::error::cve-delta.md is empty or missing" && exit 1)
        test -s cve-summary.md || (echo "::error::cve-summary.md is empty or missing" && exit 1)

        # Verify that each scan produced at least 3 CVE findings
        cve_count=$(grep -c "CVE-" cve-summary.md || echo 0)
        echo "Total CVE entries found in summary report: $cve_count"
        if [ "$cve_count" -lt 3 ]; then
          echo "::error::Expected at least 3 CVEs in cve-summary.md, found only $cve_count"
          exit 1
        fi

        echo "=== Delta Report Preview ==="
        head -n 25 cve-delta.md

        # Verify architectural column rendering behavior
        if [ "${{ matrix.image_set.expect_arch_col }}" = "true" ]; then
          grep -q "| Arch |" cve-delta.md || (echo "::error::Expected Arch column in multi-arch report" && exit 1)
        else
          if grep -q "| Arch |" cve-delta.md; then
            echo "::error::Did not expect Arch column in single-arch report" && exit 1
          fi
        fi
        echo "✅ All assertions passed (including >= 3 CVEs verification)."

    - name: Archive SBOMs and CVE Reports
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: sboms-and-reports-${{ matrix.image_set.name }}-inbuild-${{ matrix.use_inbuild_sbom }}
        path: |
          sboms/
          cve-reports/
          cve-delta.md
          cve-summary.md
        if-no-files-found: ignore