check scan result properly

Author: anthony-nhs

.github/scripts/check_ecr_image_scan_results.sh

@@ -1,4 +1,5 @@
-#!/bin/bash
+#!/usr/bin/env bash
+set -e
 
 if [ -z "${REPOSITORY_NAME}" ]; then
   echo "REPOSITORY_NAME not set"
@@ -17,12 +18,14 @@ function wait_for_scan() {
     echo "SCAN IS NOT YET COMPLETE..."
     sleep 3
   done
+  echo "Final sleep to ensure suppressions are applied correctly"
+  sleep 5
 }
 
 function check_for_high_critical_vuln() {
   scan_results=$(aws ecr describe-image-scan-findings --repository-name "${REPOSITORY_NAME}" --image-id imageTag="${IMAGE_TAG}")
-  high=$(echo "$scan_results" | jq .imageScanFindings.findingSeverityCounts.HIGH)
-  critical=$(echo "$scan_results" | jq .imageScanFindings.findingSeverityCounts.CRITICAL)
+  high=$(echo "$scan_results" | jq '.imageScanFindings.enhancedFindings[]? | select(.severity == "HIGH" and .status != "SUPPRESSED")')
+  critical=$(echo "$scan_results" | jq '.imageScanFindings.enhancedFindings[]? | select(.severity == "CRITICAL" and .status != "SUPPRESSED")')
 }
 
 function return_scan_results() {
@@ -35,20 +38,31 @@ function return_error() {
     echo -e "\n**********************************************************"
     echo "**********************************************************"
     echo "**********************************************************"
-    echo "ERROR: There are CRITICAL/HIGH vulnerabilties. Stopping build."
+    echo "ERROR: There are CRITICAL/HIGH vulnerabilities. Stopping build."
     echo "**********************************************************"
     echo "**********************************************************"
     echo "**********************************************************"
     exit 2
 }
 
 function analyze_scan_results() {
-  if [[ $critical -gt 0 ]]; then
-    echo "ERROR: There are CRITICAL vulnerabilties. Stopping build."
+  if [[ -n "$critical" ]]; then
+    echo "ERROR: There are CRITICAL vulnerabilities. Stopping build."
+
+    echo "=== BEGIN CRITICAL IMAGE SCAN RESULTS ==="
+    echo "$critical"
+    echo "=== END CRITICAL IMAGE SCAN RESULTS ==="
+
     return_scan_results
+
     return_error
-  elif [[ $high -gt 0 ]]; then
-    echo "ERROR: There are HIGH vulnerabilties. Stopping build."
+  elif [[ -n "$high" ]]; then
+    echo "ERROR: There are HIGH vulnerabilities. Stopping build."
+
+    echo "=== BEGIN HIGH IMAGE SCAN RESULTS ==="
+    echo "$high"
+    echo "=== END HIGH IMAGE SCAN RESULTS ==="
+
     return_scan_results
     return_error
   else