Philipp/cve-differential
Public Access
1
0 Fork 0
generated from Philipp/template-git
Code Issues 1 Pull Requests 1 Actions Packages Releases 1 Activity

feat: support dynamic multi-architecture discovery and iteration

Browse Source
This commit is contained in:
Philipp committed 2026-09-13 22:42:40 +02:00
1 parent abe45ffb02
commit e232a22547
3 files changed
+165 -65
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+5 -4
View File
@@ -6,9 +6,9 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
## ✨ Features
- **Multi-Platform Support**: Automatically detects and extracts SPDX SBOM attestations for multi arch images.
- **Fast Attestation Extraction**: Uses `docker buildx imagetools inspect` to extract SBOMs directly from registry manifest indices in seconds without downloading layer blobs.
- **Graceful Fallbacks**: If SBOM attestations or baseline images are missing, automatically falls back to generating SBOMs directly with Trivy. Using images that do contain an SBOM is highly recomended though!
- **Dynamic Multi-Platform Support**: Automatically discovers and scans all architectures present in container images, or iterates over an explicit list of target architectures.
- **Fast Attestation Extraction**: Uses `docker buildx imagetools inspect` to extract platform-specific SBOMs directly from registry manifest indices in seconds without downloading layer blobs.
- **Graceful Fallbacks**: If SBOM attestations are missing for any platform, automatically falls back to generating SBOMs directly with Trivy per architecture.
- **Set-Based Differential Analysis**: Categorizes vulnerabilities into:
- 🔴 **Introduced Vulnerabilities** (newly added in this branch / commit)
- 🟢 **Fixed Vulnerabilities** (present in target baseline, resolved in this branch)
@@ -20,10 +20,11 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
## 📥 Inputs
| Input | Description | Required | Default |
| :--- | :--- | :---: | :--- |
| :--- | :--- | :--- | :--- |
| `head-image` | Head container image reference to scan (e.g. `registry.example.com/repo:git-sha`) | **Yes** | — |
| `target-image` | Target baseline container image reference to compare against (e.g. `registry.example.com/repo:latest`) | **Yes** | — |
| `target-branch` | Target branch name for report headings | No | `main` |
| `architectures` | Comma-separated architectures/platforms to scan (e.g. `amd64,arm64`). If omitted, scans all architectures present in the image. | No | _(all)_ |
| `output-delta` | Output path for the CVE delta Markdown report | No | `cve-delta.md` |
| `output-summary` | Output path for the full vulnerability Markdown summary | No | `cve-summary.md` |
| `write-summary` | Whether to append the generated reports to the job summary (`$GITHUB_STEP_SUMMARY`) | No | `true` |