#!/bin/sh
set -eu

if [ "$#" -eq 0 ]; then
    echo "usage: scripts/scan-images.sh IMAGE [IMAGE ...]" >&2
    exit 2
fi

trivy_version="0.70.0"
archive="trivy_${trivy_version}_Linux-64bit.tar.gz"
expected_sha256="8b4376d5d6befe5c24d503f10ff136d9e0c49f9127a4279fd110b727929a5aa9"
temp_dir="$(mktemp -d)"
trap 'rm -rf "$temp_dir"' EXIT HUP INT TERM

curl --fail --silent --show-error --location \
    "https://github.com/aquasecurity/trivy/releases/download/v${trivy_version}/${archive}" \
    --output "$temp_dir/$archive"
printf '%s  %s\n' "$expected_sha256" "$temp_dir/$archive" | sha256sum --check --status
tar -C "$temp_dir" -xzf "$temp_dir/$archive" trivy

for image in "$@"; do
    "$temp_dir/trivy" image \
        --exit-code 1 \
        --ignore-unfixed \
        --severity HIGH,CRITICAL \
        --scanners vuln \
        --no-progress \
        "$image"
done