# =============================================================================
# L0 STATIC — the CVE scanner's supply chain and privileges are what docs/17 "Security of the scanner
# itself" says (R-VULN-09). Offline, no cluster.
#
# WHY SCOPE, NOT REQUIREMENTS: the property spans platform/vuln-scanner and renovate.json5. A
# requirement-scoped selection would miss a Renovate edit that quietly lets the scanner auto-merge.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-scanner-supply-chain
  labels:
    conformance.home.k3s/R-VULN-09: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-09"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      The scanner image is pinned by digest and is not a banned Trivy version; Renovate never
      auto-merges it and proposes it only after 7 days; its RBAC holds get/list/watch only and no
      Secret; the pod is unprivileged with bounded resources and a size-limited cache. Each is
      proven by mutation.
spec:
  steps:
    - name: assert-supply-chain-and-privileges
      description: >-
        Parse platform/vuln-scanner/deployment.yaml, rbac.yaml and renovate.json5, assert the
        digest/version/Renovate/RBAC/security-context contract, and run each evaluator on mutated
        copies to prove it can fail.
      try:
        - script:
            content: bash ./check.sh