# L1 fixture test: runs check.py (python3 stdlib, source imported from platform/vuln-scanner/src,
# no cluster, no network beyond loopback). conformance/run.sh --layer l1 runs check.sh offline;
# this Chainsaw Test wraps the same script so an in-cluster run executes identical assertions.
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-scanner-acceptances
  labels:
    conformance.home.k3s/R-VULN-08: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-08"
    conformance.home.k3s/layer: "L1"
    conformance.home.k3s/safety-critical: "false"
    # Whole-repo scope: the touched-path map keys nothing to platform/vuln-scanner, so without this
    # a change to the scanner would select no vuln-scanner test.
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/intent: >-
      Given acceptance files, When parsed and applied, Then expiry reverts to open and malformed entries never hide a finding.
spec:
  steps:
    - name: run-offline-check
      description: Run check.sh, the same assertions the offline harness runs.
      try:
        - script:
            content: bash ./check.sh