#!/bin/sh
set -eu

TRIVY_IMAGE="${TRIVY_IMAGE:-aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969}"
TRIVY_CACHE_DIR="${TRIVY_CACHE_DIR:-.cache/trivy}"
TRIVY_SEVERITY="${TRIVY_SEVERITY:-HIGH,CRITICAL}"
TRIVY_EXIT_CODE="${TRIVY_EXIT_CODE:-0}"
TRIVY_IGNORE_UNFIXED="${TRIVY_IGNORE_UNFIXED:-true}"
TRIVY_IMAGE_SOURCE="${TRIVY_IMAGE_SOURCE:-docker}"

usage() {
  echo "Usage: $0 secret-fs|vuln-fs|vuln-image <target>" >&2
}

if [ "$#" -ne 2 ]; then
  usage
  exit 2
fi

mode="$1"
target="$2"

mkdir -p "$TRIVY_CACHE_DIR"

common_args="--cache-dir /trivy-cache"
ignore_unfixed_arg=""
if [ "$TRIVY_IGNORE_UNFIXED" = "true" ]; then
  ignore_unfixed_arg="--ignore-unfixed"
fi

case "$mode" in
  secret-fs)
    container_id="$(docker create \
      -v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
      "$TRIVY_IMAGE" \
      fs \
      $common_args \
      --scanners secret \
      --exit-code 1 \
      --skip-dirs /work/.git \
      --skip-dirs /work/.agents \
      --skip-dirs /work/.cache \
      --skip-dirs /work/.codex \
      --skip-dirs /work/.opencode \
      --skip-dirs /work/.venv \
      --skip-dirs /work/frontend \
      --skip-dirs /work/node_modules \
      --skip-dirs /work/.next \
      /work)"
    trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true' EXIT
    docker cp "$target" "$container_id:/work"
    docker start -a "$container_id"
    ;;
  vuln-fs)
    container_id="$(docker create \
      -v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
      "$TRIVY_IMAGE" \
      fs \
      $common_args \
      --scanners vuln \
      --severity "$TRIVY_SEVERITY" \
      $ignore_unfixed_arg \
      --exit-code "$TRIVY_EXIT_CODE" \
      --skip-dirs /work/.git \
      --skip-dirs /work/.agents \
      --skip-dirs /work/.cache \
      --skip-dirs /work/.codex \
      --skip-dirs /work/.opencode \
      --skip-dirs /work/.venv \
      --skip-dirs /work/frontend \
      --skip-dirs /work/node_modules \
      --skip-dirs /work/.next \
      "/work/$target")"
    trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true' EXIT
    docker cp . "$container_id:/work"
    docker start -a "$container_id"
    ;;
  vuln-image)
    case "$TRIVY_IMAGE_SOURCE" in
      docker)
        docker run --rm \
          -v /var/run/docker.sock:/var/run/docker.sock \
          -v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
          "$TRIVY_IMAGE" \
          image \
          $common_args \
          --scanners vuln \
          --severity "$TRIVY_SEVERITY" \
          $ignore_unfixed_arg \
          --exit-code "$TRIVY_EXIT_CODE" \
          "$target"
        ;;
      remote)
        docker_config_dir="${DOCKER_CONFIG:-$HOME/.docker}"
        if [ ! -f "$docker_config_dir/config.json" ]; then
          echo "Docker registry credentials not found: $docker_config_dir/config.json" >&2
          exit 1
        fi
        docker run --rm \
          -e DOCKER_CONFIG=/root/.docker \
          -v "$docker_config_dir/config.json:/root/.docker/config.json:ro" \
          -v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
          "$TRIVY_IMAGE" \
          image \
          $common_args \
          --image-src remote \
          --scanners vuln \
          --severity "$TRIVY_SEVERITY" \
          $ignore_unfixed_arg \
          --exit-code "$TRIVY_EXIT_CODE" \
          "$target"
        ;;
      *)
        echo "Unsupported TRIVY_IMAGE_SOURCE: $TRIVY_IMAGE_SOURCE (expected docker or remote)" >&2
        exit 2
        ;;
    esac
    ;;
  *)
    usage
    exit 2
    ;;
esac