[PLUTO-1411] Add trivy test

Author: zhamborova

.github/workflows/trivy-plugin-test.yml

@@ -0,0 +1,46 @@
+name: Trivy Plugin Test
+
+permissions:
+  contents: write
+
+on:
+  push:
+    paths:
+      - 'plugins/tools/trivy/**'
+      - '.github/workflows/trivy-plugin-test.yml'
+  pull_request:
+    paths:
+      - 'plugins/tools/trivy/**'
+      - '.github/workflows/trivy-plugin-test.yml'
+
+jobs:
+  test:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Download CLI binaries
+        uses: actions/download-artifact@v4
+        with:
+          name: cli-binaries
+          path: .
+
+      - name: Select Linux binary
+        run: mv cli-v2-linux cli-v2
+
+      - name: Make binary executable
+        run: chmod +x cli-v2
+
+      - name: Run Trivy plugin tests
+        run: |
+          cd plugins/tools/trivy/test
+          # Install the plugin
+          ../../../cli-v2 install
+          # Run analysis
+          ../../../cli-v2 analyze --tool trivy --format sarif --output actual.sarif
+          # Compare with expected output
+          diff expected.sarif actual.sarif
+          # Clean up
+          rm actual.sarif 

plugins/tools/trivy/test/expected.sarif

@@ -0,0 +1,85 @@
+{
+  "version": "2.1.0",
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "Trivy",
+          "version": "0.59.1",
+          "informationUri": "https://github.com/aquasecurity/trivy",
+          "rules": [
+            {
+              "id": "CVE-2021-23343",
+              "shortDescription": {
+                "text": "Command injection in lodash"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "external/cwe/cwe-78"
+                ],
+                "precision": "very-high"
+              }
+            },
+            {
+              "id": "CVE-2020-28500",
+              "shortDescription": {
+                "text": "Regular Expression Denial of Service in moment"
+              },
+              "properties": {
+                "tags": [
+                  "security",
+                  "external/cwe/cwe-400"
+                ],
+                "precision": "very-high"
+              }
+            }
+          ]
+        }
+      },
+      "results": [
+        {
+          "ruleId": "CVE-2021-23343",
+          "level": "error",
+          "message": {
+            "text": "Command injection in lodash"
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 7,
+                  "startColumn": 5
+                }
+              }
+            }
+          ]
+        },
+        {
+          "ruleId": "CVE-2020-28500",
+          "level": "error",
+          "message": {
+            "text": "Regular Expression Denial of Service in moment"
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "package.json"
+                },
+                "region": {
+                  "startLine": 9,
+                  "startColumn": 5
+                }
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+} 

plugins/tools/trivy/test/src/.codacy/codacy.yaml

@@ -0,0 +1,3 @@
+runtimes:
+tools:
+    - [email protected]

plugins/tools/trivy/test/src/Dockerfile

@@ -0,0 +1,20 @@
+FROM node:12.0.0
+
+# Using an old version of npm that has known vulnerabilities
+RUN npm install -g [email protected]
+
+# Copy application files
+WORKDIR /app
+COPY package*.json ./
+
+# Install dependencies with known vulnerabilities
+RUN npm install [email protected]
+
+# Copy source code
+COPY . .
+
+# Expose port
+EXPOSE 3000
+
+# Start the application
+CMD ["node", "app.js"] 

plugins/tools/trivy/test/src/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "trivy-test-app",
+  "version": "1.0.0",
+  "description": "Test application for Trivy vulnerability scanning",
+  "main": "app.js",
+  "dependencies": {
+    "express": "4.16.4",
+    "lodash": "4.17.15",
+    "moment": "2.24.0"
+  }
+}