#!/usr/bin/env bash
set -euo pipefail

project_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${project_dir}"

./scripts/audit-web-image.sh

runtime_image="${RUNTIME_AUDIT_IMAGE:-k1412-agent-runtime:audit}"
gateway_image="${GATEWAY_AUDIT_IMAGE:-k1412-agent-gateway:audit}"
workspace_image="${WORKSPACE_AUDIT_IMAGE:-k1412-agent-workspace:audit}"
trivy_image="aquasec/trivy@sha256:cffe3f5161a47a6823fbd23d985795b3ed72a4c806da4c4df16266c02accdd6f"
trivy_cache="k1412-trivy-cache"

docker build --platform linux/amd64 -f docker/runtime.Dockerfile -t "${runtime_image}" .
docker build --platform linux/amd64 -f docker/gateway.Dockerfile -t "${gateway_image}" .
docker build --platform linux/amd64 -f docker/workspace.Dockerfile -t "${workspace_image}" .

for image in "${runtime_image}" "${gateway_image}" "${workspace_image}"; do
  docker run --rm "${image}" python -m pip check
  docker run --rm \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v "${trivy_cache}:/root/.cache" \
    "${trivy_image}" \
    image \
    --quiet \
    --scanners vuln \
    --severity HIGH,CRITICAL \
    --ignore-unfixed \
    --exit-code 1 \
    --format json \
    "${image}" >/dev/null
done