Skip to content

Commit 17d9f80

Browse files
kenhyskenhys
committed
ci: use machine readabla
In the previous versions, ad-hoc and broken Markdown was rendered in some cases. Use --output json and convert it to GFM. * (filter) ignore Negligible in .vulnerability.severity * Show fixed version from .vulnerability.fix.versions[0] or (wont-fix) or empty in FIXED IN column * Show deb or gem from .artifact.type in TYPE column * Show CVE from .vulnerability.id in VULNERABILITY column Signed-off-by: Kentaro Hayashi <[email protected]>
1 parent 45dba6a commit 17d9f80

File tree

1 file changed

+39
-12
lines changed

1 file changed

+39
-12
lines changed

‎.github/workflows/scan-images.yml‎

Lines changed: 39 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,20 @@ jobs:
3838
# v1.19.1-debian-amd64
3939
IMAGE=$(make echo-all-images | cut -d' ' -f1|cut -d',' -f3)
4040
echo "# Scan Fluentd image with grype (filter)" >> $GITHUB_STEP_SUMMARY
41-
docker run --rm anchore/grype:latest fluent/fluentd:$IMAGE --ignore-states wont-fix | grep -v Negligible >> $GITHUB_STEP_SUMMARY
41+
docker run --rm anchore/grype:latest fluent/fluentd:$IMAGE --ignore-states wont-fix --output json | jq --raw-output '
42+
(["NAME","INSTALLED","FIXED IN","TYPE","VULNERABILITY","SEVERITY"] | join(" | ") | "| " + . + " |"),
43+
(["---","---","---","---","---","---"] | join(" | ") | "| " + . + " |"),
44+
(.matches[]
45+
| select(.vulnerability.severity != "Negligible")
46+
| "| \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // (if .vulnerability.fix.state == "not-fixed" then "" else "(" + .vulnerability.fix.state + ")" end)) | \(.artifact.type) | \(.vulnerability.id) | \(.vulnerability.severity)|")
47+
' >> $GITHUB_STEP_SUMMARY
4248
echo "# Scan Fluentd image with grype (details)" >> $GITHUB_STEP_SUMMARY
43-
echo "|NAME | INSTALLED | FIXED | IN | TYPE | VULNERABILITY | SEVERITY | EPSS | RISK | |" >> $GITHUB_STEP_SUMMARY
44-
echo "|---| ---|---|---|----|---|---|---|---|---|" >> $GITHUB_STEP_SUMMARY
45-
docker run --rm anchore/grype:latest fluent/fluentd:$IMAGE | sed -e "s/won't fix/won'tfix/g" | grep -v "^NAME" | sed 's/^/|/; s/ */ | /g; s/$/ |/' >> $GITHUB_STEP_SUMMARY
49+
docker run --rm anchore/grype:latest fluent/fluentd:$IMAGE --output json | jq --raw-output '
50+
(["NAME","INSTALLED","FIXED IN","TYPE","VULNERABILITY","SEVERITY"] | join(" | ") | "| " + . + " |"),
51+
(["---","---","---","---","---","---"] | join(" | ") | "| " + . + " |"),
52+
(.matches[]
53+
| "| \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // (if .vulnerability.fix.state == "not-fixed" then "" else "(" + .vulnerability.fix.state + ")" end)) | \(.artifact.type) | \(.vulnerability.id) | \(.vulnerability.severity)|")
54+
' >> $GITHUB_STEP_SUMMARY
4655
ruby:
4756
name: Scan Ruby image with grype
4857
strategy:
@@ -53,11 +62,20 @@ jobs:
5362
run: |
5463
docker pull ruby:3.4-slim
5564
echo "# Scan Ruby image with grype (filter)" >> $GITHUB_STEP_SUMMARY
56-
docker run --rm anchore/grype:latest ruby:3.4-slim --ignore-states wont-fix | grep -v Negligible >> $GITHUB_STEP_SUMMARY
65+
docker run --rm anchore/grype:latest ruby:3.4-slim --ignore-states wont-fix --format json | jq --raw-output '
66+
(["NAME","INSTALLED","FIXED IN","TYPE","VULNERABILITY","SEVERITY"] | join(" | ") | "| " + . + " |"),
67+
(["---","---","---","---","---","---"] | join(" | ") | "| " + . + " |"),
68+
(.matches[]
69+
| select(.vulnerability.severity != "Negligible")
70+
| "| \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // (if .vulnerability.fix.state == "not-fixed" then "" else "(" + .vulnerability.fix.state + ")" end)) | \(.artifact.type) | \(.vulnerability.id) | \(.vulnerability.severity)|")
71+
' >> $GITHUB_STEP_SUMMARY
5772
echo "# Scan Ruby image with grype (details)" >> $GITHUB_STEP_SUMMARY
58-
echo "|NAME | INSTALLED | FIXED | IN | TYPE | VULNERABILITY | SEVERITY | EPSS | RISK | |" >> $GITHUB_STEP_SUMMARY
59-
echo "|---| ---|---|---|----|---|---|---|---|---|" >> $GITHUB_STEP_SUMMARY
60-
docker run --rm anchore/grype:latest ruby:3.4-slim | sed -e "s/won't fix/won'tfix/g" | grep -v "^NAME" | sed 's/^/|/; s/ */ | /g; s/$/ |/' >> $GITHUB_STEP_SUMMARY
73+
docker run --rm anchore/grype:latest ruby:3.4-slim --output json | jq --raw-output '
74+
(["NAME","INSTALLED","FIXED IN","TYPE","VULNERABILITY","SEVERITY"] | join(" | ") | "| " + . + " |"),
75+
(["---","---","---","---","---","---"] | join(" | ") | "| " + . + " |"),
76+
(.matches[]
77+
| "| \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // (if .vulnerability.fix.state == "not-fixed" then "" else "(" + .vulnerability.fix.state + ")" end)) | \(.artifact.type) | \(.vulnerability.id) | \(.vulnerability.severity)|")
78+
' >> $GITHUB_STEP_SUMMARY
6179
debian:
6280
name: Scan debian image with grype
6381
strategy:
@@ -68,8 +86,17 @@ jobs:
6886
run: |
6987
docker pull debian:trixie
7088
echo "# Scan debian image with grype (filter)" >> $GITHUB_STEP_SUMMARY
71-
docker run --rm anchore/grype:latest debian:trixie --ignore-states wont-fix | grep -v Negligible >> $GITHUB_STEP_SUMMARY
89+
docker run --rm anchore/grype:latest debian:trixie --ignore-states wont-fix --output json | jq --raw-output '
90+
(["NAME","INSTALLED","FIXED IN","TYPE","VULNERABILITY","SEVERITY"] | join(" | ") | "| " + . + " |"),
91+
(["---","---","---","---","---","---"] | join(" | ") | "| " + . + " |"),
92+
(.matches[]
93+
| select(.vulnerability.severity != "Negligible")
94+
| "| \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // (if .vulnerability.fix.state == "not-fixed" then "" else "(" + .vulnerability.fix.state + ")" end)) | \(.artifact.type) | \(.vulnerability.id) | \(.vulnerability.severity)|")
95+
' >> $GITHUB_STEP_SUMMARY
7296
echo "# Scan debian image with grype (details)" >> $GITHUB_STEP_SUMMARY
73-
echo "|NAME | INSTALLED | FIXED | IN | TYPE | VULNERABILITY | SEVERITY | EPSS | RISK | |" >> $GITHUB_STEP_SUMMARY
74-
echo "|---| ---|---|---|----|---|---|---|---|---|" >> $GITHUB_STEP_SUMMARY
75-
docker run --rm anchore/grype:latest debian:trixie | sed -e "s/won't fix/won'tfix/g" | grep -v "^NAME" | sed 's/^/|/; s/ */ | /g; s/$/ |/' >> $GITHUB_STEP_SUMMARY
97+
docker run --rm anchore/grype:latest debian:trixie --output json | jq --raw-output '
98+
(["NAME","INSTALLED","FIXED IN","TYPE","VULNERABILITY","SEVERITY"] | join(" | ") | "| " + . + " |"),
99+
(["---","---","---","---","---","---"] | join(" | ") | "| " + . + " |"),
100+
(.matches[]
101+
| "| \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // (if .vulnerability.fix.state == "not-fixed" then "" else "(" + .vulnerability.fix.state + ")" end)) | \(.artifact.type) | \(.vulnerability.id) | \(.vulnerability.severity)|")
102+
' >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)