# =============================================================================
# L0 STATIC — the CVE triage bot workflow fails loudly and is shaped like Renovate's (R-VULN-05,
# R-VULN-07, docs/17 "The triage bot"). Offline, no cluster. Depends on .gitea/workflows/cve-triage.yaml
# (the BOT's file); fails until that file is integrated.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-triage-bot-workflow-guards
  labels:
    conformance.home.k3s/R-VULN-05: "true"
    conformance.home.k3s/R-VULN-07: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-05, R-VULN-07"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      The bot workflow runs on the 07:15 cron, has a workflow_dispatch dry-run input, never runs
      concurrently with itself, and a step fails the job hard when RENOVATE_TOKEN is empty.
      Proven by mutation.
spec:
  steps:
    - name: assert-workflow-guards
      description: >-
        Parse .gitea/workflows/cve-triage.yaml and assert the trigger, concurrency and hard
        credential failure, then run the evaluator on mutated copies to prove it can fail.
      try:
        - script:
            content: bash ./check.sh