name: Test

on:
  push:
  pull_request:
  workflow_dispatch:

env:
  BATS_LIB_PATH: '/usr/lib/'

jobs:
  lint:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
        with:
          advanced-security: false

  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Setup Bats and bats libs
        id: setup-bats
        uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0

      - name: Install Trivy
        run: make ensure-trivy TRIVY_INSTALL_DIR=/usr/local/bin

      - name: Test
        env:
          BATS_LIB_PATH: ${{ steps.setup-bats.outputs.lib-path }}
        run: make test