#!/usr/bin/env bash
set -euo pipefail

project_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${project_dir}"

image="${WEB_AUDIT_IMAGE:-k1412-agent-web:audit}"
trivy_image="aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f"
trivy_cache="k1412-trivy-cache"
docker build -f docker/web.Dockerfile -t "${image}" .

docker run --rm --entrypoint sh "${image}" -lc '
  python -m pip check &&
  python -m pip install -q pip-audit &&
  python -m pip_audit
'

docker volume inspect "${trivy_cache}" >/dev/null 2>&1 \
  || docker volume create "${trivy_cache}" >/dev/null
trivy=(docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v "${trivy_cache}:/root/.cache" \
  "${trivy_image}")
scan_args=(image --quiet --scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1)
if ! "${trivy[@]}" "${scan_args[@]}" --format json "${image}" >/dev/null; then
  "${trivy[@]}" "${scan_args[@]}" "${image}" || true
  exit 1
fi