*** Settings ***
Documentation     Integration tests for CI Dockerfile.server security scanning
...               Validates that the CI workflow includes the Trivy security scan step
...               configured to fail on HIGH/CRITICAL vulnerabilities (issue #1927).
Resource          ${CURDIR}/common.resource
Suite Setup       Setup Test Environment
Suite Teardown    Cleanup Test Environment

*** Test Cases ***
CI Workflow Contains Trivy Security Scan Step
    [Documentation]    Verify the docker CI job includes the Trivy security scan step
    [Tags]    security    ci    dockerfile
    ${content}=    Get File    ${WORKSPACE}/.forgejo/workflows/ci.yml
    Should Contain    ${content}    Security scan Dockerfile.server image with Trivy

CI Workflow Targets Dockerfile Server Image
    [Documentation]    Verify the CI scan targets the Dockerfile.server image specifically
    [Tags]    security    ci    dockerfile
    ${content}=    Get File    ${WORKSPACE}/.forgejo/workflows/ci.yml
    Should Contain    ${content}    Dockerfile.server
    Should Contain    ${content}    cleveragents-server:test

CI Trivy Configured To Fail On High Severity
    [Documentation]    Verify Trivy exits non-zero on HIGH or CRITICAL findings
    [Tags]    security    ci    dockerfile
    ${content}=    Get File    ${WORKSPACE}/.forgejo/workflows/ci.yml
    Should Contain    ${content}    --severity HIGH,CRITICAL
    Should Contain    ${content}    --exit-code 1
    Should Contain    ${content}    --ignore-unfixed

CI Trivy Uses Pinned Docker Image
    [Documentation]    Verify Trivy runs from a pinned upstream Docker image
    [Tags]    security    ci    dockerfile
    ${content}=    Get File    ${WORKSPACE}/.forgejo/workflows/ci.yml
    Should Contain    ${content}    TRIVY_IMAGE="aquasec/trivy:0.58.0"
    Should Contain    ${content}    docker pull "$\{TRIVY_IMAGE}"

CI Trivy Scans Image Through Docker Socket
    [Documentation]    Verify Trivy can inspect the Dockerfile.server image built in dind
    [Tags]    security    ci    dockerfile
    ${content}=    Get File    ${WORKSPACE}/.forgejo/workflows/ci.yml
    Should Contain    ${content}    -v /var/run/docker.sock:/var/run/docker.sock
    Should Contain    ${content}    cleveragents-server:test

Dockerfile Server Exists In Repository
    [Documentation]    Verify Dockerfile.server exists at the expected repository location
    [Tags]    security    dockerfile
    File Should Exist    ${WORKSPACE}/Dockerfile.server