name: Image Extracting and Security Scanning

on:
  push:
    branches:
    - master
  pull_request:
    paths:
    - '.github/workflows/trivy.yaml'
    - 'tests/trivy_scan.py'

permissions:
  contents: read
  actions: read

jobs:
  image-extraction-and-security-scan:
    if: ${{ github.repository == 'kubeflow/manifests' }}
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    # Install kustomize
    - name: Install kustomize
      run: |
        bash tests/kustomize_install.sh

    # Install trivy
    - name: Install trivy
      run: |
        bash tests/trivy_install.sh

    # Install Python
    - name: Setup Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'

    # Install prettytable package
    - name: Install prettytable
      run: |
        pip install prettytable

    - name: Run image extracting and security scanning script
      run: |
        cd tests
        python3 trivy_scan.py

    - name: Upload trivy scanned_results
      uses: actions/upload-artifact@v4
      with:
        name: trivy_scanned_results
        path: image_lists/
