Philipp/cve-differential
Public Access
1
0 Fork 0
generated from Philipp/template-git
Code Issues 1 Pull Requests 1 Actions Packages Releases 1 Activity

feat: warn when an image has 0 reported CVEs and display warning banner
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 47s
Details

Browse Source
This commit is contained in:
Philipp committed 2026-09-13 20:02:35 +02:00
1 parent 3b458f8749
commit 77f3cf68e4
2 files changed
+42 -19
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

action.yaml
+12 -2
View File
@@ -235,7 +235,12 @@ runs:
if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
if [ -s "$out_json" ]; then
vuln_cnt=$(grep -o '"VulnerabilityID"' "$out_json" 2>/dev/null | wc -l || echo 0)
head_summary+=(" - ${arch}: ✅ OK (${vuln_cnt} vulnerability findings)")
if [ "$vuln_cnt" -eq 0 ]; then
echo "::warning::Head image architecture '${arch}' has 0 CVE findings. Verify that OS/packages were recognized."
head_summary+=(" - ${arch}: ⚠️ WARNING (0 vulnerability findings detected)")
else
head_summary+=(" - ${arch}: ✅ OK (${vuln_cnt} vulnerability findings)")
fi
head_report_count=$((head_report_count + 1))
else
head_ok=false
@@ -264,7 +269,12 @@ runs:
if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
if [ -s "$out_json" ]; then
vuln_cnt=$(grep -o '"VulnerabilityID"' "$out_json" 2>/dev/null | wc -l || echo 0)
target_summary+=(" - ${arch}: ✅ OK (${vuln_cnt} vulnerability findings)")
if [ "$vuln_cnt" -eq 0 ]; then
echo "::warning::Target baseline image architecture '${arch}' has 0 CVE findings. Verify that OS/packages were recognized."
target_summary+=(" - ${arch}: ⚠️ WARNING (0 vulnerability findings detected)")
else
target_summary+=(" - ${arch}: ✅ OK (${vuln_cnt} vulnerability findings)")
fi
target_report_count=$((target_report_count + 1))
else
target_ok=false