Philipp/cve-differential
Public Access
1
0 Fork 0
generated from Philipp/template-git
Code Issues 1 Pull Requests 1 Actions Packages Releases 1 Activity
63 Commits 3 Branches 2 Tags
1666786617e552a641963b83877006a157e0fc7e
Commit Graph
19 Commits
Author SHA1 Message Date
Renovate 1666786617 chore(deps): update dependency aquasecurity/trivy to v0.76.1
CI Tests / cross-check-mixed-sbom (sbom=true) (push) Skipped
CI Tests / without-inbuild-sbom (sbom=false) (push) Skipped
CI Tests / without-inbuild-sbom (sbom=true) (push) Skipped
CI Tests / with-inbuild-sbom (sbom=false) (push) Skipped
CI Tests / with-inbuild-sbom (sbom=true) (push) Skipped
renovate/artifacts Artifact file update failure
CI Tests / JS Unit Tests (push) Skipped
CI Tests / cross-check-mixed-sbom (sbom=false) (push) Skipped
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m36s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Failing after 1m45s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 31s
Details
CI Tests / JS Unit Tests (pull_request) Successful in 6m14s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Failing after 1m17s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 1m45s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Failing after 1m12s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Failing after 29s
Details
2026-10-21 12:25:17 +00:00
Renovate 6b70a25cf6 chore(deps): update dependency aquasecurity/trivy to v0.75.0
CI Tests / JS Unit Tests (push) Skipped
CI Tests / cross-check-mixed-sbom (sbom=true) (push) Skipped
CI Tests / without-inbuild-sbom (sbom=false) (push) Skipped
CI Tests / without-inbuild-sbom (sbom=true) (push) Skipped
CI Tests / with-inbuild-sbom (sbom=false) (push) Skipped
CI Tests / with-inbuild-sbom (sbom=true) (push) Skipped
renovate/artifacts Artifact file update failure
CI Tests / cross-check-mixed-sbom (sbom=false) (push) Skipped
CI Tests / JS Unit Tests (pull_request) Successful in 5m11s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 2m56s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 1m33s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 1m26s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Failing after 1m28s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Failing after 1m28s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Failing after 1m31s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Failing after 1m54s
Details
2026-10-01 22:14:56 +00:00
Philipp 9e607b1a24 Revert "Merge pull request 'refactor(action): replace bash blocks with zero-dependency Node.js modules' (#17) from feat-bash-to-js-refactor into main"
CI Tests / JS Unit Tests (push) Skipped
CI Tests / cross-check-mixed-sbom (sbom=false) (push) Skipped
CI Tests / cross-check-mixed-sbom (sbom=true) (push) Skipped
CI Tests / without-inbuild-sbom (sbom=false) (push) Skipped
CI Tests / without-inbuild-sbom (sbom=true) (push) Skipped
CI Tests / with-inbuild-sbom (sbom=false) (push) Skipped
CI Tests / with-inbuild-sbom (sbom=true) (push) Skipped
CI Tests / JS Unit Tests (pull_request) Successful in 9s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 2m34s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 4m20s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 6m15s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 4m45s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 3m50s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 3m54s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 3m35s
Details 
This reverts commit 17e5dab1b2, reversing
changes made to 46c4fedc47.
 2026-09-15 01:24:04 +02:00
Philipp 493d119b3c Merge branch 'main' into feat-bash-to-js-refactor
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m43s
Details
CI Tests / JS Unit Tests (pull_request) Successful in 16s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Failing after 2m48s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Failing after 3m13s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Failing after 3m13s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 3m15s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Failing after 4m38s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 4m39s
Details
2026-09-15 00:49:02 +02:00
Philipp 77357f0c3f refactor(action): replace bash blocks with zero-dependency Node.js modules
CI Tests / JS Unit Tests (pull_request) Successful in 46s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m54s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Failing after 3m22s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 2m38s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Failing after 4m21s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Failing after 5m36s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Failing after 6m47s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 2m59s
Details 
Extract ~450 lines of complex bash from action.yaml into modular,
unit-tested Node.js scripts in lib/. All logic is covered by 26 native
node:test unit tests (node --test, no external dependencies).

Modules added:
- lib/platforms.js   - platform parsing and OCI manifest auto-discovery
- lib/distro.js      - SPDX PURL distro detection (os_name/os_version)
- lib/verifier.js    - Trivy arch mapping and SHA256 verification
- lib/diagnostics.js - CI terminal diagnostic formatters
- lib/install-trivy.js  - Trivy install/verify entrypoint (replaces bash step)
- lib/extract-sboms.js  - SBOM extraction entrypoint (replaces bash step)
- lib/scan-sboms.js     - SBOM scan + diff entrypoint (replaces bash step)

Tests added (all pass, auto-discovered by
ode --test):
- test/platforms.test.js
- test/distro.test.js
- test/verifier.test.js
- test/diagnostics.test.js
- test/orchestration.test.js

action.yaml shrinks from 554 to 107 lines. Inputs are bridged to Node
scripts via INPUT_* env vars so modules are fully decoupled from the
Actions runner and testable in isolation.
 2026-09-15 00:39:13 +02:00
Philipp 8070a3c155 Merge branch 'main' into renovate/actions-cache-6.x
CI Tests / JS Unit Tests (pull_request) Successful in 9s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 2m2s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 4m34s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 5m16s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 7m5s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 2m55s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 3m7s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 2m24s
Details
2026-09-15 00:32:49 +02:00
Philipp def42c37a8 docs: document trade-offs and differences between in-build and direct scanning
CI Tests / JS Unit Tests (pull_request) Successful in 8s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m34s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 2m35s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 2m42s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 7m5s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 5m52s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 5m46s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 2m22s
Details
2026-09-15 00:12:42 +02:00
Philipp 64747ec466 fix: robustly parse distro from in-build SBOM package PURLs
CI Tests / JS Unit Tests (pull_request) Successful in 8s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m35s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 3m3s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 3m11s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 5m32s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 5m32s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 1m49s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 7m2s
Details
2026-09-14 23:37:07 +02:00
Philipp 3b9043a746 feat: detect distro from in-build SBOM PURLs and pass --distro to trivy
CI Tests / JS Unit Tests (pull_request) Successful in 8s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m35s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 2m57s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 3m5s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 3m59s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 5m34s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 3m52s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 1m36s
Details
2026-09-14 23:25:09 +02:00
Philipp d89fb25d7b test: add unit tests for cve-diff and fallback for in-build sbom scans
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 3m0s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 3m0s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 3m1s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 7m14s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 7m14s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 7m32s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m29s
Details
2026-09-14 22:27:49 +02:00
Renovate 2ece0c93ac chore(deps): update actions/cache action to v6
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 2m0s
Details
2026-09-14 17:27:56 +00:00
Philipp e394966a96 feat: show Arch column only when multiple architectures are scanned
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 3m5s
Details
2026-09-13 22:46:05 +02:00
Philipp e232a22547 feat: support dynamic multi-architecture discovery and iteration 2026-09-13 22:42:40 +02:00
Philipp 86a00c54dc feat: add use-inbuild-sbom input defaulting to false
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 35s
Details
2026-09-13 20:34:52 +02:00
Philipp 77f3cf68e4 feat: warn when an image has 0 reported CVEs and display warning banner
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 47s
Details
2026-09-13 20:02:35 +02:00
Philipp 3b458f8749 feat: add dual-side diagnostic overview and gating to ensure both scans succeed
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 36s
Details
2026-09-13 19:58:54 +02:00
Philipp e4a0cac9ff refactor: internalize trivy version management and remove input
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 36s
Details
2026-09-13 03:41:34 +02:00
Philipp f246ae5fcd feat: add write-summary option to publish reports to step summary
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 33s
Details
2026-09-13 00:41:19 +02:00
Philipp bf996103f5 feat: initial commit of cve-differential action 2026-09-13 00:12:26 +02:00