name: Judge an image
description: >-
  The CIS gate (image_tools/cis.py) and the CycloneDX SBOM (image_tools/sbom.py)
  of one platform image, kept as <out>/cis-<arch>.json, cis-<arch>.md and
  sbom-<arch>.cdx.json for bin/sign.sh. The step fails when CIS is red.
inputs:
  image:
    description: The image to judge, as Docker can run it (local tag or reference)
    required: true
  arch:
    description: Its platform, amd64 or arm64
    required: true
  decisions:
    description: The image repository's CIS decisions
    default: cis.toml
  packages:
    description: The packages the image may hold
    default: packages.allow
  out:
    description: Where the results go
    default: attest
runs:
  using: composite
  steps:
    - name: CIS
      shell: bash
      env:
        IMAGE: ${{ inputs.image }}
        ARCH: ${{ inputs.arch }}
        DECISIONS: ${{ inputs.decisions }}
        PACKAGES: ${{ inputs.packages }}
        OUT: ${{ inputs.out }}
        PYTHONPATH: ${{ github.action_path }}/../..
      run: |
        mkdir -p "$OUT"
        python3 -m image_tools.cis "$IMAGE" --decisions "$DECISIONS" --packages "$PACKAGES" \
          --json "$OUT/cis-$ARCH.json" --report "$OUT/cis-$ARCH.md"
    - name: SBOM
      shell: bash
      env:
        IMAGE: ${{ inputs.image }}
        ARCH: ${{ inputs.arch }}
        OUT: ${{ inputs.out }}
        PYTHONPATH: ${{ github.action_path }}/../..
      run: python3 -m image_tools.sbom "$IMAGE" "$OUT/sbom-$ARCH.cdx.json"