name: Judge a rebuild against the pin
description: >-
  Whether a candidate improves on the pinned image, by netOrk's matcher in
  kb-server (image_tools/verify.py). Writes verdict.json and report.md, prints
  the report, and fails when no verdict could be reached. The caller passes
  NETORK_LICENSE_KEY, and TRIVY_USERNAME/TRIVY_PASSWORD for the registry, as env.
inputs:
  current:
    description: The pinned image
    required: true
  candidate:
    description: The rebuild
    required: true
  packages:
    description: The packages the image may hold, for the CIS part of the verdict
    default: packages.allow
outputs:
  improved:
    description: '"true" when the candidate improves on the pin'
    value: ${{ steps.verdict.outputs.improved }}
runs:
  using: composite
  steps:
    - id: verdict
      shell: bash
      env:
        CURRENT: ${{ inputs.current }}
        CANDIDATE: ${{ inputs.candidate }}
        PACKAGES: ${{ inputs.packages }}
        PYTHONPATH: ${{ github.action_path }}/../..
      run: |
        python3 -m image_tools.verify "$CURRENT" "$CANDIDATE" --packages "$PACKAGES" \
          --json verdict.json --report report.md
        # Into the log: Gitea shows no step summary.
        cat report.md
        cat report.md >> "$GITHUB_STEP_SUMMARY"
        python3 -c "import json; print('improved=' + str(json.load(open('verdict.json'))['improved']).lower())" >> "$GITHUB_OUTPUT"
        # A verdict that could not be reached is no "same": the step fails, so it is seen.
        python3 -c "import json, sys; e = json.load(open('verdict.json'))['error']; sys.exit(f'no verdict: {e}' if e else 0)"