#!/usr/bin/env bash
set -euo pipefail
root=/work/acb/my-devsecops
out=/work/acb/devsecops-local-test
rc=0
bash "$root/scripts/scan-image.sh" "$root/images/zap-stable-amd64.tar" "$out/trivy-image" || rc=$?
echo "Trivy gate exit: $rc"
[[ "$rc" == 0 || "$rc" == 1 ]]
rc=0
bash "$root/scripts/scan-supply-chain.sh" docker-archive "$root/images/zap-stable-amd64.tar" "$out/grype-image" || rc=$?
echo "Grype gate exit: $rc"
[[ "$rc" == 0 || "$rc" == 2 ]]
python3 - "$out" <<'PY'
import json,sys
from pathlib import Path
p=Path(sys.argv[1])
t=json.loads((p/'trivy-image/trivy-image.json').read_text())
g=json.loads((p/'grype-image/grype.json').read_text())
assert t.get('Results'), 'Trivy has no results'
for f in ['trivy-image/image.cdx.json','grype-image/sbom.cdx.json']:
 s=json.loads((p/f).read_text()); assert s['bomFormat']=='CycloneDX' and s.get('components')
print('Trivy High/Critical findings:',sum(v['Severity'] in ['HIGH','CRITICAL'] for r in t['Results'] for v in r.get('Vulnerabilities',[])))
print('Grype High/Critical findings:',sum(m['vulnerability']['severity'] in ['High','Critical'] for m in g['matches']))
print('PASS: actual image archive scanned offline by both tools; nonempty SBOMs parsed. Findings are not release approval.')
PY