#!/usr/bin/env bash
set -euo pipefail
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
input="${1:?Usage: scan-image.sh IMAGE_TAR REPORT_DIRECTORY}"
[[ -f "$input" && -r "$input" && -s "$input" ]] || {
    echo "Image archive is missing, unreadable, or empty: $input" >&2
    echo 'Export a real local image successfully with podman save before scanning.' >&2
    exit 2
}
archive="$(realpath "$input")"
mkdir -p "${2:?Specify report directory}"
reports="$(realpath "$2")"
cache="${TRIVY_CACHE_DIR:-$root/cache/trivy}"
python3 "$root/scripts/check-db-age.py" "$cache"
common=(--cache-dir "$cache" --offline-scan --skip-db-update --skip-java-db-update
        --skip-check-update --skip-version-check --disable-telemetry --input "$archive")
status=0
"$root/bin/trivy" image "${common[@]}" --scanners vuln --severity HIGH,CRITICAL \
    --exit-code 1 --format json --output "$reports/trivy-image.json" || status=1
"$root/bin/trivy" image "${common[@]}" --scanners vuln --format cyclonedx \
    --output "$reports/image.cdx.json" || status=1
exit "$status"