# =============================================================================
# L1 RENDERING — the bot ticks only qualifying approve rows (R-VULN-05, R-VULN-07)
# Spec: docs/17 "The triage bot" and its L1 acceptance gates. GIVEN a Renovate dashboard in the
# real issue #91 format plus a constructed Pending Approval section, WHEN the bot plans ticks,
# THEN only `approve` rows exact-matching an image with an unaccepted CRITICAL with a fix change,
# by exactly their marker, and every negative row stays byte-identical.
#
# render-check.sh is a pure offline check; this Chainsaw Test wraps the SAME script.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-triage-bot-approval-ticks
  labels:
    conformance.home.k3s/R-VULN-05: "true"
    conformance.home.k3s/R-VULN-07: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-05,R-VULN-07"
    conformance.home.k3s/layer: "L1"
    conformance.home.k3s/safety-critical: "false"
    # The script under test lives in .gitea/workflows/, which requirement-scoped selection does
    # not attribute to R-VULN-*, so a change to it must still select this test.
    conformance.home.k3s/scope: "whole-repo"
    conformance.home.k3s/intent: >-
      A tick is applied only to an approve row for an image with a qualifying finding, and dry
      runs, duplicate prevention and heartbeat ordering hold through the whole run.
spec:
  steps:
    - name: plan-and-assert-ticks
      try:
        - script:
            content: bash ./render-check.sh