#!/usr/bin/env bash
# Record every scanner outcome; the final gate makes the combined decision.
set -euo pipefail
name="${1:?syft, grype, or trivy}"
mkdir -p /security/status
status=0
case "$name" in
  syft) tool-security image /artifacts/app.tar /security/sbom || status=$? ;;
  grype) tool-security sbom /security/sbom/sbom.syft.json /security/grype || status=$? ;;
  trivy) tool-security image /artifacts/app.tar /security/trivy || status=$? ;;
  *) exit 2 ;;
esac
printf '%s\n' "$status" > "/security/status/$name.exit"
echo "$name completed with exit code $status; final security-gate will evaluate the result"