diff --git a/.github/workflows/Test-Rock.yaml b/.github/workflows/Test-Rock.yaml index 0a9fa1b2..2143daf0 100644 --- a/.github/workflows/Test-Rock.yaml +++ b/.github/workflows/Test-Rock.yaml @@ -271,6 +271,36 @@ jobs: name: ${{ steps.configure-trivy.outputs.report-name }} path: ${{ steps.configure-trivy.outputs.report-name}} + + # We have to walk through the vulnerabilities since trivy does not support outputting the results as Markdown + - name: Create markdown content + id: create-markdown + if: ${{ !cancelled() }} + run: | + set -x + + vulnerabilities="$(jq -r -c '[ + try(.scanner.result.Results[]) + | .Target as $target + | .Vulnerabilities + | select(. != null) + | .[] + | {Target: $target, LastModifiedDate: .LastModifiedDate, VulnerabilityID: .VulnerabilityID, + PkgName: .PkgName, Severity: .Severity} + ]' < ${{ steps.configure-trivy.outputs.report-name }})" + + num_vulns=$(echo "$vulnerabilities" | jq -r 'length') + + if [[ $num_vulns -gt 0 ]]; then + echo "# Vulnerabilities found for ${{ inputs.oci-archive-name }}" >> $GITHUB_STEP_SUMMARY + title="Vulnerabilities found for ${{ inputs.oci-archive-name }}" + echo "## $title" >> $GITHUB_STEP_SUMMARY + echo "| ID | Target | Severity | Package |" >> $GITHUB_STEP_SUMMARY + echo "| -- | ----- | -------- | ------- |" >> $GITHUB_STEP_SUMMARY + echo "$vulnerabilities" | jq -r '.[] | "| \(.VulnerabilityID) | /\(.Target) | \(.Severity) | \(.PkgName) |"' >> $GITHUB_STEP_SUMMARY + fi + + test-malware: runs-on: ubuntu-22.04 name: "test-malware ${{ inputs.oci-archive-name != '' && format('| {0}', inputs.oci-archive-name) || ' '}}" diff --git a/.github/workflows/Vulnerability-Scan.yaml b/.github/workflows/Vulnerability-Scan.yaml index 2e82b05a..d81dfd95 100644 --- a/.github/workflows/Vulnerability-Scan.yaml +++ b/.github/workflows/Vulnerability-Scan.yaml @@ -213,12 +213,6 @@ jobs: echo "issue-body-file=issue.md" >> "$GITHUB_OUTPUT" fi - - name: Write to summary - if: ${{ !inputs.create-issue && steps.create-markdown.outputs.vulnerability-exists == 'true' }} - run: | - echo "# Vulnerabilities found for ${{ inputs.oci-image-name }}" >> $GITHUB_STEP_SUMMARY - cat ${{ steps.create-markdown.outputs.issue-body-file }} | tail -n +2 >> $GITHUB_STEP_SUMMARY - - id: issue-exists if: ${{ inputs.create-issue}} run: |