#!/bin/bash
# Container Image Vulnerability Scanner
# Usage: ./scan-images.sh <image> [--severity HIGH,CRITICAL] [--format json|table]

set -euo pipefail

IMAGE="${1:-}"
SEVERITY="${2:-HIGH,CRITICAL}"
FORMAT="${3:-table}"

if [ -z "$IMAGE" ]; then
    echo "Usage: $0 <image> [--severity HIGH,CRITICAL] [--format json|table]"
    exit 1
fi

echo "========================================="
echo "Scanning Image: $IMAGE"
echo "Severity Filter: $SEVERITY"
echo "========================================="
echo ""

# Check which scanner is available
if command -v trivy &>/dev/null; then
    echo "Using Trivy scanner..."
    trivy image \
        --severity "$SEVERITY" \
        --format "$FORMAT" \
        --ignore-unfixed \
        "$IMAGE"
        
elif command -v grype &>/dev/null; then
    echo "Using Grype scanner..."
    grype "$IMAGE" \
        --only-fixed \
        --fail-on high \
        -o "$FORMAT"
        
elif command -v docker &>/dev/null && docker scout version &>/dev/null 2>&1; then
    echo "Using Docker Scout..."
    docker scout cves "$IMAGE" \
        --only-severity critical,high \
        --format "$FORMAT"
        
else
    echo "Error: No vulnerability scanner found."
    echo "Install one of: trivy, grype, or docker scout"
    exit 1
fi

echo ""
echo "========================================="
echo "Scan complete"
echo "========================================="