From f246ae5fcd0c4d59dc812d18bbe4f62561717a6f Mon Sep 17 00:00:00 2001 From: Philipp Horstenkamp Date: Sun, 13 Sep 2026 00:41:19 +0200 Subject: [PATCH 1/4] feat: add write-summary option to publish reports to step summary --- README.md | 1 + action.yaml | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/README.md b/README.md index 07286d2..2eb5503 100644 --- a/README.md +++ b/README.md @@ -27,6 +27,7 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p | `trivy-version` | Trivy version to install and verify | No | `0.74.0` | | `output-delta` | Output path for the CVE delta Markdown report | No | `cve-delta.md` | | `output-summary` | Output path for the full vulnerability Markdown summary | No | `cve-summary.md` | +| `write-summary` | Whether to append the generated reports to the job summary (`$GITHUB_STEP_SUMMARY`) | No | `true` | --- diff --git a/action.yaml b/action.yaml index 3386b8c..b93fdf6 100644 --- a/action.yaml +++ b/action.yaml @@ -24,6 +24,10 @@ inputs: description: Output markdown file for full vulnerability summary required: false default: cve-summary.md + write-summary: + description: Whether to append the generated reports to the job summary ($GITHUB_STEP_SUMMARY) + required: false + default: 'true' outputs: delta-report: @@ -184,3 +188,15 @@ runs: --output "${{ inputs.output-summary }}" \ "$primary_sbom" || true fi + + - name: Publish Reports to Step Summary + shell: bash + run: | + if [ "${{ inputs.write-summary }}" = "true" ] && [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then + if [ -f "${{ inputs.output-delta }}" ]; then + cat "${{ inputs.output-delta }}" >> "$GITHUB_STEP_SUMMARY" + fi + if [ -f "${{ inputs.output-summary }}" ]; then + cat "${{ inputs.output-summary }}" >> "$GITHUB_STEP_SUMMARY" + fi + fi From b3a2f082e1d15222da697c62f80ebd5f5dc9c49f Mon Sep 17 00:00:00 2001 From: Philipp Horstenkamp Date: Sun, 13 Sep 2026 00:42:46 +0200 Subject: [PATCH 2/4] fix(template): remove misconfigurations and secrets sections from markdown.tpl --- markdown.tpl | 36 ++---------------------------------- 1 file changed, 2 insertions(+), 34 deletions(-) diff --git a/markdown.tpl b/markdown.tpl index 45bab8e..f229108 100644 --- a/markdown.tpl +++ b/markdown.tpl @@ -14,10 +14,7 @@ {{- end }} {{- end }} -{{- $hasFindings := false }} - {{- if .Vulnerabilities }} -{{- $hasFindings = true }} #### Target: `{{ $targetName }}` (Vulnerabilities) | Severity | CVE | Package | Installed | Fixed In | Title | @@ -30,38 +27,9 @@ {{- end }} {{- end }} {{- end }} -{{- end }} - -{{- if .Misconfigurations }} -{{- $hasFindings = true }} -#### Target: `{{ $targetName }}` (Misconfigurations) - -| Severity | Rule ID | Title | Message | Resolution | -| :--- | :--- | :--- | :--- | :--- | -{{- $misconfs := .Misconfigurations }} -{{- range $sev := list "CRITICAL" "HIGH" "MEDIUM" "LOW" "UNKNOWN" }} -{{- range $m := $misconfs }} -{{- if eq $m.Severity $sev }} -| {{ if eq $m.Severity "CRITICAL" }}🔴 CRITICAL{{ else if eq $m.Severity "HIGH" }}🟠 HIGH{{ else if eq $m.Severity "MEDIUM" }}🟡 MEDIUM{{ else if eq $m.Severity "LOW" }}🔵 LOW{{ else }}⚪ {{ $m.Severity }}{{ end }} | [{{ $m.ID }}]({{ $m.PrimaryURL }}) | {{ $m.Title }} | {{ $m.Message }} | {{ default "-" $m.Resolution }} | -{{- end }} -{{- end }} -{{- end }} -{{- end }} - -{{- if .Secrets }} -{{- $hasFindings = true }} -#### Target: `{{ $targetName }}` (Secrets) - -| Severity | Rule ID | Title | Lines | -| :--- | :--- | :--- | :--- | -{{- range .Secrets }} -| {{ if eq .Severity "CRITICAL" }}🔴 CRITICAL{{ else if eq .Severity "HIGH" }}🟠 HIGH{{ else if eq .Severity "MEDIUM" }}🟡 MEDIUM{{ else if eq .Severity "LOW" }}🔵 LOW{{ else }}⚪ {{ .Severity }}{{ end }} | {{ .RuleID }} | {{ .Title }} | L{{ .StartLine }}-L{{ .EndLine }} | -{{- end }} -{{- end }} - -{{- if not $hasFindings }} +{{- else }} #### Target: `{{ $targetName }}` -✅ No security issues found. +✅ No vulnerabilities found. {{- end }} {{- end }} From d4fc8d7b1690d849efed564014ec698ce27f8651 Mon Sep 17 00:00:00 2001 From: Philipp Horstenkamp Date: Sun, 13 Sep 2026 00:43:30 +0200 Subject: [PATCH 3/4] docs: shorten usage example in README.md --- README.md | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/README.md b/README.md index 2eb5503..4715a52 100644 --- a/README.md +++ b/README.md @@ -60,18 +60,11 @@ jobs: tags: registry.example.com/my-app:git-${{ github.sha }} - name: Compare Vulnerabilities (Head vs Target) - uses: Philipp/cve-differential@main + uses: https://git.horstenkamp.eu/Philipp/cve-differential@main with: head-image: registry.example.com/my-app:git-${{ github.sha }} target-image: registry.example.com/my-app:latest target-branch: ${{ github.base_ref || 'main' }} - - - name: Publish CVE Delta to Job Summary - if: always() - run: | - if [ -f cve-delta.md ]; then - cat cve-delta.md >> "$GITHUB_STEP_SUMMARY" - fi ``` --- From e9ec17323b7e11f61e7122350693cf20f2ceee69 Mon Sep 17 00:00:00 2001 From: Philipp Horstenkamp Date: Sun, 13 Sep 2026 01:07:07 +0200 Subject: [PATCH 4/4] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 4715a52..01f2cba 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# CVE Differential (`cve-differential`) +# CVE Differential A self-contained Gitea and GitHub Actions composite action that extracts multi-platform SBOM attestations from container images, runs vulnerability scans with [Trivy](https://github.com/aquasecurity/trivy), and produces a set-based CVE delta report between a head image and a target baseline image.