name: Test

on:
  push:
  pull_request:
  workflow_dispatch:

env:
  BATS_LIB_PATH: '/usr/lib/'

jobs:
  lint:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
        with:
          advanced-security: false

  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup Bats and bats libs
        id: setup-bats
        uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0

      - name: Install Trivy
        run: make ensure-trivy TRIVY_INSTALL_DIR=/usr/local/bin

      - name: Test
        env:
          BATS_LIB_PATH: ${{ steps.setup-bats.outputs.lib-path }}
        run: make test