Fix passing args to vulnapi binary

.github/workflows/ci.yml

@@ -48,17 +48,50 @@ jobs:
     name: GitHub Actions Test
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      packages: read
+
+    env:
+      DOCKER_IMAGE: ghcr.io/cerberauth/api-vulns-challenges/jwt-strong-eddsa-key:latest
+
     steps:
       - name: Checkout
-        id: checkout
         uses: actions/checkout@v4
 
-      - name: Test Local Action
-        id: test-action
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Server
+        run: |
+          docker run -d -p 8080:8080 ${{ env.DOCKER_IMAGE }}
+          sleep 5
+
+      - name: Get JWT
+        id: get-jwt
+        run: |
+          echo "jwt=$(docker run --rm ${{ env.DOCKER_IMAGE }} jwt)" >> $GITHUB_OUTPUT
+
+      - name: Test CURL Local Action
         uses: ./
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          curl:
-            'curl https://api.github.com/repos/${{ github.repository
-            }}/actions/runs/${{ github.run_id }}/jobs'
+          curl: |
+            curl http://localhost:8080 -H "Authorization: Bearer ${{ steps.get-jwt.outputs.jwt }}" --scans "jwt.*"
+
+      # - name: Test OpenAPI Local Action
+      #   uses: ./
+      #   env:
+      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      #   with:
+      #     openapi: ./__tests__/openapi.yaml
+
+      - name: Stop Server
+        if: ${{ always() }}
+        run:
+          docker stop $(docker ps -q --filter ancestor=${{ env.DOCKER_IMAGE }})

__tests__/openapi.yaml

@@ -0,0 +1,27 @@
+openapi: 3.1.0
+
+info:
+  title: Fake API
+  description: A fake API for testing purposes
+  version: 1.0.0
+servers:
+  - url: http://localhost:8080
+paths:
+  /example:
+    get:
+      summary: Retrieve an example resource
+      responses:
+        '200':
+          description: Successful response
+          content:
+            application/json:
+              schema:
+                type: object
+                components:
+                  securitySchemes:
+                    bearerAuth:
+                      type: http
+                      scheme: bearer
+                      bearerFormat: JWT
+                security:
+                  - bearerAuth: []