Ensure Image Vulnerability Scanning Is Enabled

#!/usr/bin/env bash
#
# Enable image vulnerability scanning for:
# - Google Container Registry (GCR): containeranalysis.googleapis.com
# - Artifact Registry (AR): containerscanning.googleapis.com
#
# Run this on any machine with:
# - gcloud installed
# - authenticated to the target GCP project
# - correct IAM permissions to enable services
#
# Usage:
#   PROJECT_ID=your-project-id ./enable_image_scanning.sh
# or:
#   ./enable_image_scanning.sh your-project-id
#

set -euo pipefail

PROJECT_ID="${PROJECT_ID:-${1:-}}"

if [[ -z "${PROJECT_ID}" ]]; then
  echo "ERROR: PROJECT_ID not set and no project ID argument provided."
  echo "Usage: PROJECT_ID=your-project-id $0"
  echo "   or: $0 your-project-id"
  exit 1
fi

echo "Using project: ${PROJECT_ID}"
gcloud config set project "${PROJECT_ID}" >/dev/null

enable_service_if_needed() {
  local service="$1"

  if gcloud services list --enabled --format="value(config.name)" \
      --filter="config.name=${service}" | grep -qx "${service}"; then
    echo "Service already enabled: ${service}"
  else
    echo "Enabling service: ${service}"
    gcloud services enable "${service}"
    echo "Enabled service: ${service}"
  fi
}

echo "Ensuring vulnerability scanning services are enabled..."

# For images hosted in GCR
enable_service_if_needed "containeranalysis.googleapis.com"

# For images hosted in Artifact Registry
enable_service_if_needed "containerscanning.googleapis.com"

echo "Verifying configuration..."

echo -n "containerscanning.googleapis.com (Artifact Registry scanning): "
if gcloud services list --enabled --format="value(config.name)" \
    --filter="config.name=containerscanning.googleapis.com" | \
    grep -qx "containerscanning.googleapis.com"; then
  echo "enabled"
else
  echo "disabled (verification failed)"
  exit 1
fi

echo -n "containeranalysis.googleapis.com (GCR vulnerability scanning backend): "
if gcloud services list --enabled --format="value(config.name)" \
    --filter="config.name=containeranalysis.googleapis.com" | \
    grep -qx "containeranalysis.googleapis.com"; then
  echo "enabled"
else
  echo "disabled (verification failed)"
  exit 1
fi

echo "All required vulnerability scanning services are enabled."