feat: warn when an image has 0 reported CVEs and display warning banner

cve-diff.js

@@ -149,19 +149,17 @@ function formatVulnRow(v) {
  * @returns {string}
  */
 function renderMarkdownDiff(baseCves, branchCves, baseName = 'main') {
-  if (baseCves.size === 0) {
-    return [
-      `### 🔄 Vulnerability Delta (vs \`${baseName}\`)`,
-      '',
-      '> [!NOTE]',
-      `> No baseline scan from \`${baseName}\` was available to compare against.`,
-      '',
-    ].join('\n');
-  }
-
   const baseKeys = new Set(baseCves.keys());
   const branchKeys = new Set(branchCves.keys());
 
+  if (branchCves.size === 0) {
+    console.error('::warning::Head image contains 0 reported vulnerabilities. Verify that packages and dependencies were recognized.');
+  }
+
+  if (baseCves.size === 0) {
+    console.error(`::warning::Baseline target (${baseName}) contains 0 reported vulnerabilities.`);
+  }
+
   const newKeys = [];
   let unchangedCount = 0;
   for (const key of branchKeys) {
@@ -196,15 +194,30 @@ function renderMarkdownDiff(baseCves, branchCves, baseName = 'main') {
   const lines = [
     `### 🔄 Vulnerability Delta (vs \`${baseName}\`)`,
     '',
-    '| Metric | Count |',
-    '| :--- | :--- |',
-    `| 🚨 **New Vulnerabilities** | ${newVulns.length > 0 ? `🚨 **${newVulns.length}**` : '0'} |`,
-    `| ✅ **Resolved Vulnerabilities** | ${resolvedVulns.length > 0 ? `✅ **${resolvedVulns.length}**` : '0'} |`,
-    `| ⚪ **Unchanged Vulnerabilities** | ${unchangedCount} |`,
-    '',
-    `#### 🚨 New Vulnerabilities Introduced (${newVulns.length})`,
   ];
 
+  if (branchCves.size === 0 && baseCves.size === 0) {
+    lines.push('> [!WARNING]');
+    lines.push('> Both the head image and baseline target have **0 reported vulnerabilities**.');
+    lines.push('');
+  } else if (branchCves.size === 0) {
+    lines.push('> [!WARNING]');
+    lines.push('> The head image has **0 reported vulnerabilities**. Verify that OS packages and language dependencies were properly indexed in the SBOM.');
+    lines.push('');
+  } else if (baseCves.size === 0) {
+    lines.push('> [!WARNING]');
+    lines.push(`> The baseline image (\`${baseName}\`) has **0 reported vulnerabilities**.`);
+    lines.push('');
+  }
+
+  lines.push('| Metric | Count |');
+  lines.push('| :--- | :--- |');
+  lines.push(`| 🚨 **New Vulnerabilities** | ${newVulns.length > 0 ? `🚨 **${newVulns.length}**` : '0'} |`);
+  lines.push(`| ✅ **Resolved Vulnerabilities** | ${resolvedVulns.length > 0 ? `✅ **${resolvedVulns.length}**` : '0'} |`);
+  lines.push(`| ⚪ **Unchanged Vulnerabilities** | ${unchangedCount} |`);
+  lines.push('');
+  lines.push(`#### 🚨 New Vulnerabilities Introduced (${newVulns.length})`);
+
   if (newVulns.length > 0) {
     lines.push('| Severity | CVE | Package | Arch | Installed | Fixed In | Title |');
     lines.push('| :--- | :--- | :--- | :--- | :--- | :--- | :--- |');