#!/usr/bin/env bash
set -euo pipefail

if [ "$#" -lt 1 ]; then
    echo "Usage: $0 doca-*-vuln.csv [more.csv ...]" >&2
    exit 1
fi

python3 - "$@" <<'PY'
import csv
import os
import re
import sys

FILENAME_RE = re.compile(
    r"^doca-(?P<container>.+)-(?P<version>\d+\.\d+\.\d+)-(?P<host>host|dpu)-vuln\.csv$"
)

META_COLUMNS = ["doca_version", "doca_host", "doca_container"]


def parse_metadata(path):
    base = os.path.basename(path)
    match = FILENAME_RE.match(base)

    if not match:
        raise ValueError(
            f"Filename does not match expected pattern: {base}\n"
            f"Expected: doca-(container)-(version)-(host)-vuln.csv"
        )

    return {
        "doca_version": match.group("version"),
        "doca_host": match.group("host"),
        "doca_container": match.group("container"),
    }


def is_critical(row):
    fields_to_check = [
        "nvd_severity",
        "severity",
        "osv_severity",
    ]

    for field in fields_to_check:
        value = row.get(field, "")
        if value and "CRITICAL" in value.upper():
            return True

    return False


def main(paths):
    writer = None
    output_header = None

    for path in paths:
        metadata = parse_metadata(path)

        with open(path, "r", encoding="utf-8", newline="") as f:
            reader = csv.DictReader(f)

            if reader.fieldnames is None:
                continue

            if writer is None:
                original_header = reader.fieldnames
                output_header = META_COLUMNS + original_header
                writer = csv.DictWriter(
                    sys.stdout,
                    fieldnames=output_header,
                    extrasaction="ignore",
                )
                writer.writeheader()

            for row in reader:
                if not is_critical(row):
                    continue

                output_row = {}
                output_row.update(metadata)
                output_row.update(row)
                writer.writerow(output_row)


if __name__ == "__main__":
    main(sys.argv[1:])
PY