#!/usr/bin/env bash
# Reproduce the BomLens supplier-SBOM lab. Run from a folder that contains:
#   bomlens/           (git clone --depth 1 https://github.com/sktelecom/bomlens.git)
#   acme-payments/     (package.json + index.js from this bundle)
#   vendor-sbom.json   (the deliberately bad supplier SBOM from this bundle)
set -uo pipefail
SCRIPT="./bomlens/scripts/scan-sbom.sh"

echo "== Leg A: be the supplier. Generate an SBOM + reports from source =="
"$SCRIPT" --project acme-payments --version 2.3.0 --target acme-payments \
  --supplier "Acme Corp <https://acme.example>" --all --generate-only

echo "== Leg B1: be the receiver. Validate a GOOD SBOM (our own, fed back) =="
"$SCRIPT" --project acme-received-good --version 2.3.0 \
  --analyze acme-payments_2.3.0/acme-payments_2.3.0_bom.json \
  --conformance-profile skt-submission --generate-only

echo "== Leg B2: be the receiver. Validate a BAD supplier SBOM =="
"$SCRIPT" --project acme-received-bad --version 2.3.0 \
  --analyze vendor-sbom.json \
  --conformance-profile skt-submission --generate-only

echo "== Leg C1: CI gate on conformance (expect exit 2) =="
"$SCRIPT" --project gate-conf --version 1 --analyze vendor-sbom.json \
  --conformance-profile skt-submission --fail-on-conformance --generate-only
echo "exit=$?"

echo "== Leg C2: CI gate on severity (expect exit 4) =="
"$SCRIPT" --project gate-vuln --version 1 \
  --analyze acme-payments_2.3.0/acme-payments_2.3.0_bom.json \
  --fail-on vulnerability=high --generate-only
echo "exit=$?"