name: Verify the base images
description: >-
  Every image the Dockerfiles build on, and every image named in refs, is
  signed with netOrk's key, checked before the build (NetOrk/netork#1390,
  bin/verify-base.sh, bin/verify-signature.sh). Give one or both.
inputs:
  dockerfiles:
    description: Dockerfiles whose FROM images to verify, separated by spaces
    default: ""
  refs:
    description: >-
      Images to verify, <image>@<digest>, separated by spaces: for a FROM the
      Dockerfile only knows as an argument
    default: ""
runs:
  using: composite
  steps:
    - name: Install cosign
      shell: bash
      run: bash "${{ github.action_path }}/../../bin/install-cosign.sh"
    - name: Verify
      shell: bash
      env:
        DOCKERFILES: ${{ inputs.dockerfiles }}
        REFS: ${{ inputs.refs }}
      # The lists split on spaces on purpose.
      run: |
        if [ -z "$DOCKERFILES$REFS" ]; then
          echo "verify-base: give dockerfiles, refs or both" >&2
          exit 1
        fi
        if [ -n "$DOCKERFILES" ]; then
          # shellcheck disable=SC2086
          bash "${{ github.action_path }}/../../bin/verify-base.sh" $DOCKERFILES
        fi
        if [ -n "$REFS" ]; then
          # shellcheck disable=SC2086
          bash "${{ github.action_path }}/../../bin/verify-signature.sh" $REFS
        fi