name: Verify the base images
description: >-
  Every image the Dockerfiles build on is signed with netOrk's key, checked
  before the build (NetOrk/netork#1390, bin/verify-base.sh).
inputs:
  dockerfiles:
    description: The Dockerfiles, separated by spaces, relative to the workspace
    required: true
runs:
  using: composite
  steps:
    - name: Install cosign
      shell: bash
      run: bash "${{ github.action_path }}/../../bin/install-cosign.sh"
    - name: Verify
      shell: bash
      env:
        DOCKERFILES: ${{ inputs.dockerfiles }}
      # shellcheck disable=SC2086 # the list splits on purpose
      run: bash "${{ github.action_path }}/../../bin/verify-base.sh" $DOCKERFILES