{{ define "vuln-badge" }}
{{ if .Error }}
{{/* Hold unreachable. Warning color distinguishes from "not scanned" (gray). */}}
<span class="badge badge-sm badge-warning" title="Hold is unreachable; try again in a moment">
    {{ icon "wifi-off" "size-3" }} Hold offline
</span>
{{ else if .NotScanned }}
<span class="badge badge-sm badge-ghost" title="No scan recorded yet">Not scanned</span>
{{ else if .Skipped }}
{{/* Artifact is intentionally not scanned (helm chart, in-toto, DSSE).
     Render an empty span — the artifact-type badge already tells the user
     this isn't a container image, so a separate "not scannable" pill is
     redundant noise on listings. */}}
<span></span>
{{ else if .ScanFailed }}
<span class="badge badge-sm badge-warning" title="Scanner ran but produced no SBOM">{{ icon "alert-triangle" "size-3" }} Scan failed</span>
{{ else if eq .Total 0 }}
<span class="badge badge-sm badge-success" title="No vulnerabilities found (scanned {{ .ScannedAt }})">{{ icon "shield-check" "size-3" }} Clean</span>
{{ else }}
<span class="vuln-strip" role="group" aria-label="Vulnerabilities: {{ .Critical }} critical, {{ .High }} high, {{ .Medium }} medium, {{ .Low }} low (scanned {{ .ScannedAt }})" title="Vulnerabilities: {{ .Critical }} critical, {{ .High }} high, {{ .Medium }} medium, {{ .Low }} low (scanned {{ .ScannedAt }})">
    <span class="tooltip vuln-box-critical" data-tip="Critical" aria-label="{{ .Critical }} critical">{{ .Critical }}</span>
    <span class="tooltip vuln-box-high" data-tip="High" aria-label="{{ .High }} high">{{ .High }}</span>
    <span class="tooltip vuln-box-medium" data-tip="Medium" aria-label="{{ .Medium }} medium">{{ .Medium }}</span>
    <span class="tooltip vuln-box-low" data-tip="Low" aria-label="{{ .Low }} low">{{ .Low }}</span>
</span>
{{ end }}
{{ end }}