fix: pass reusable workflow input from event

Author: brendan-kellam

.github/scripts/test-cve-remediation.sh

@@ -5,6 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FILTER="$SCRIPT_DIR/filter-unlinked-cve-issues.jq"
 DISCOVERY_SCRIPT="$SCRIPT_DIR/find-unlinked-cve-issues.sh"
 WORKFLOW_FILE="$SCRIPT_DIR/../workflows/_cve-remediation.yml"
+CALLER_WORKFLOW_FILE="$SCRIPT_DIR/../workflows/cve-remediation.yml"
 
 assert_json() {
   local description="$1"
@@ -22,8 +23,9 @@ assert_json() {
 assert_workflow_contains() {
   local description="$1"
   local expected="$2"
+  local workflow_file="${3:-$WORKFLOW_FILE}"
 
-  if ! grep -Fq -- "$expected" "$WORKFLOW_FILE"; then
+  if ! grep -Fq -- "$expected" "$workflow_file"; then
     echo "FAIL: $description"
     echo "Expected workflow to contain: $expected"
     exit 1
@@ -33,8 +35,9 @@ assert_workflow_contains() {
 assert_workflow_not_contains() {
   local description="$1"
   local unexpected="$2"
+  local workflow_file="${3:-$WORKFLOW_FILE}"
 
-  if grep -Fq -- "$unexpected" "$WORKFLOW_FILE"; then
+  if grep -Fq -- "$unexpected" "$workflow_file"; then
     echo "FAIL: $description"
     echo "Expected workflow not to contain: $unexpected"
     exit 1
@@ -276,5 +279,13 @@ assert_workflow_not_contains \
 assert_workflow_not_contains \
   "does not use unavailable job workflow SHA context" \
   'job.workflow_sha'
+assert_workflow_contains \
+  "passes a numeric manual or scheduled issue limit through an allowed context" \
+  "fromJSON(github.event.inputs.max_issues || '50')" \
+  "$CALLER_WORKFLOW_FILE"
+assert_workflow_not_contains \
+  "does not use the unavailable inputs context in a reusable workflow call" \
+  '${{ inputs.max_issues' \
+  "$CALLER_WORKFLOW_FILE"
 
 echo "All CVE remediation tests passed."

.github/workflows/cve-remediation.yml

@@ -26,5 +26,5 @@ jobs:
   remediate:
     uses: ./.github/workflows/_cve-remediation.yml
     with:
-      max_issues: ${{ inputs.max_issues || 50 }}
+      max_issues: ${{ fromJSON(github.event.inputs.max_issues || '50') }}
     secrets: inherit