# =============================================================================
# L0 STATIC — accepted CVE risk has a reason and a bounded expiry (R-VULN-08, docs/17 "Risk acceptance").
# Offline, no cluster.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-acceptances-schema
  labels:
    conformance.home.k3s/R-VULN-08: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-08"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      platform/vuln-scanner/acceptances.yaml rejects any entry without a reason or expiry, with a
      malformed expiry, or expiring more than 180 days out. Proven with mutated negative fixtures.
spec:
  steps:
    - name: assert-acceptance-schema
      description: >-
        Validate acceptances.yaml against the docs/17 shape, then run the validator on mutated
        negative fixtures to prove it can fail.
      try:
        - script:
            content: bash ./check.sh