Philipp/cve-differential
Public Access
1
0 Fork 0
generated from Philipp/template-git
Code Issues 1 Pull Requests 1 Actions Packages Releases 1 Activity
53 Commits 3 Branches 2 Tags
4385ea7eea4657d5b19f16f6ba12196c5a23f913
Commit Graph
50 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Philipp 17e5dab1b2 Merge pull request 'refactor(action): replace bash blocks with zero-dependency Node.js modules' (#17) from feat-bash-to-js-refactor into main
CI Tests / JS Unit Tests (push) Successful in 11s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (push) Failing after 1m26s
Details
CI Tests / without-inbuild-sbom (sbom=true) (push) Failing after 3m25s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (push) Failing after 3m26s
Details
CI Tests / without-inbuild-sbom (sbom=false) (push) Failing after 3m27s
Details
CI Tests / with-inbuild-sbom (sbom=false) (push) Failing after 4m23s
Details
CI Tests / with-inbuild-sbom (sbom=true) (push) Failing after 4m23s
Details 
Reviewed-on: #17
Reviewed-by: LLMReview <27+autoreview@noreplay.horstenkamp.eu>
 2026-09-15 00:51:17 +02:00
Philipp 493d119b3c Merge branch 'main' into feat-bash-to-js-refactor
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m43s
Details
CI Tests / JS Unit Tests (pull_request) Successful in 16s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Failing after 2m48s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Failing after 3m13s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Failing after 3m13s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 3m15s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Failing after 4m38s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 4m39s
Details
2026-09-15 00:49:02 +02:00
Philipp 77357f0c3f refactor(action): replace bash blocks with zero-dependency Node.js modules
CI Tests / JS Unit Tests (pull_request) Successful in 46s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m54s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Failing after 3m22s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 2m38s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Failing after 4m21s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Failing after 5m36s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Failing after 6m47s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 2m59s
Details 
Extract ~450 lines of complex bash from action.yaml into modular,
unit-tested Node.js scripts in lib/. All logic is covered by 26 native
node:test unit tests (node --test, no external dependencies).

Modules added:
- lib/platforms.js   - platform parsing and OCI manifest auto-discovery
- lib/distro.js      - SPDX PURL distro detection (os_name/os_version)
- lib/verifier.js    - Trivy arch mapping and SHA256 verification
- lib/diagnostics.js - CI terminal diagnostic formatters
- lib/install-trivy.js  - Trivy install/verify entrypoint (replaces bash step)
- lib/extract-sboms.js  - SBOM extraction entrypoint (replaces bash step)
- lib/scan-sboms.js     - SBOM scan + diff entrypoint (replaces bash step)

Tests added (all pass, auto-discovered by
ode --test):
- test/platforms.test.js
- test/distro.test.js
- test/verifier.test.js
- test/diagnostics.test.js
- test/orchestration.test.js

action.yaml shrinks from 554 to 107 lines. Inputs are bridged to Node
scripts via INPUT_* env vars so modules are fully decoupled from the
Actions runner and testable in isolation.
 2026-09-15 00:39:13 +02:00
Philipp 46c4fedc47 Merge pull request 'chore(deps): update actions/cache action to v6' (#16) from renovate/actions-cache-6.x into main
CI Tests / JS Unit Tests (push) Successful in 2m9s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (push) Successful in 1m59s
Details
CI Tests / without-inbuild-sbom (sbom=true) (push) Successful in 3m18s
Details
CI Tests / without-inbuild-sbom (sbom=false) (push) Successful in 3m51s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (push) Successful in 3m57s
Details
CI Tests / with-inbuild-sbom (sbom=false) (push) Successful in 3m36s
Details
CI Tests / with-inbuild-sbom (sbom=true) (push) Successful in 4m45s
Details 
Reviewed-on: #16
 2026-09-15 00:38:45 +02:00
Philipp 8070a3c155 Merge branch 'main' into renovate/actions-cache-6.x
CI Tests / JS Unit Tests (pull_request) Successful in 9s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 2m2s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 4m34s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 5m16s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 7m5s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 2m55s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 3m7s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 2m24s
Details
2026-09-15 00:32:49 +02:00
Philipp 0ccfd5f512 Merge pull request 'ci: add matrix test workflow for debian slim images in .gitea' (#15) from feat-test-matrix-workflow into main
CI Tests / JS Unit Tests (push) Successful in 9s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (push) Successful in 2m46s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (push) Successful in 3m3s
Details
CI Tests / without-inbuild-sbom (sbom=true) (push) Successful in 2m57s
Details
CI Tests / without-inbuild-sbom (sbom=false) (push) Successful in 3m3s
Details
CI Tests / with-inbuild-sbom (sbom=false) (push) Successful in 2m53s
Details
CI Tests / with-inbuild-sbom (sbom=true) (push) Successful in 3m15s
Details 
Reviewed-on: #15
 2026-09-15 00:26:57 +02:00
Philipp c98b31c23a Merge branch 'main' into feat-test-matrix-workflow
CI Tests / JS Unit Tests (pull_request) Successful in 17s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m49s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 1m58s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 3m1s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 3m8s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 3m35s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 2m59s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 3m6s
Details
2026-09-15 00:17:06 +02:00
Philipp def42c37a8 docs: document trade-offs and differences between in-build and direct scanning
CI Tests / JS Unit Tests (pull_request) Successful in 8s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m34s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 2m35s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 2m42s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 7m5s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 5m52s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 5m46s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 2m22s
Details
2026-09-15 00:12:42 +02:00
Philipp 64747ec466 fix: robustly parse distro from in-build SBOM package PURLs
CI Tests / JS Unit Tests (pull_request) Successful in 8s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m35s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 3m3s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 3m11s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 5m32s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 5m32s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 1m49s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 7m2s
Details
2026-09-14 23:37:07 +02:00
Philipp 3b9043a746 feat: detect distro from in-build SBOM PURLs and pass --distro to trivy
CI Tests / JS Unit Tests (pull_request) Successful in 8s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m35s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 2m57s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 3m5s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 3m59s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 5m34s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 3m52s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 1m36s
Details
2026-09-14 23:25:09 +02:00
Philipp 790c1aa3de docs: update README with in-build fallback and unit test details
CI Tests / JS Unit Tests (pull_request) Successful in 12s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m16s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 3m45s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 3m40s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 7m8s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 4m24s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 4m24s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 1m56s
Details
2026-09-14 22:34:12 +02:00
Philipp f31be5eef6 ci: move unit tests into dedicated unit-test job
CI Tests / JS Unit Tests (pull_request) Successful in 11s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m16s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 5m57s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 5m39s
Details
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 5m58s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 5m34s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 5m38s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 5m57s
Details
2026-09-14 22:29:21 +02:00
Philipp d89fb25d7b test: add unit tests for cve-diff and fallback for in-build sbom scans
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Successful in 3m0s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 3m0s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 3m1s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 7m14s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 7m14s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Successful in 7m32s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m29s
Details
2026-09-14 22:27:49 +02:00
Philipp 6643b7449e Merge pull request 'chore(config): migrate Renovate config' (#14) from renovate/migrate-config into main 
Reviewed-on: #14
 2026-09-14 05:08:27 +02:00
Philipp 40209bbeed style: format test workflow to comply with pretty-format-yaml
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 4m58s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 5m2s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 4m8s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 4m52s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 3m57s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 4m55s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m40s
Details
2026-09-14 03:06:49 +02:00
Philipp 44c4b5a304 ci: add matrix test workflow for debian slim images in .gitea
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 9m33s
Details
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 10m38s
Details
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 10m32s
Details
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 3m9s
Details
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 5m21s
Details
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 5m25s
Details
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Failing after 5m8s
Details
2026-09-14 03:03:32 +02:00
Philipp 015e40634a Merge pull request 'feat: dynamic multi-architecture discovery, iteration, and conditional reporting' (#11) from iterate-architectures into main 
Reviewed-on: #11
 2026-09-14 00:40:44 +02:00
Philipp e394966a96 feat: show Arch column only when multiple architectures are scanned
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 3m5s
Details
2026-09-13 22:46:05 +02:00
Philipp e232a22547 feat: support dynamic multi-architecture discovery and iteration 2026-09-13 22:42:40 +02:00
Philipp abe45ffb02 Merge pull request 'feat: add dual-side diagnostic overview and fail-safe gating' (#10) from feat-diagnostic-overview-and-gating into main 
Reviewed-on: #10
Reviewed-by: LLMReview <27+autoreview@noreplay.horstenkamp.eu>
 2026-09-13 20:52:55 +02:00
Philipp e97c5b1fc9 docs: add comparison between built-in Syft SBOMs and direct Trivy scanning
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m36s
Details
2026-09-13 20:40:38 +02:00
Philipp 86a00c54dc feat: add use-inbuild-sbom input defaulting to false
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 35s
Details
2026-09-13 20:34:52 +02:00
Philipp 77f3cf68e4 feat: warn when an image has 0 reported CVEs and display warning banner
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 47s
Details
2026-09-13 20:02:35 +02:00
Philipp 3b458f8749 feat: add dual-side diagnostic overview and gating to ensure both scans succeed
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 36s
Details
2026-09-13 19:58:54 +02:00
Philipp d49634fba5 Merge pull request 'refactor: internalize trivy version management and remove input' (#9) from internalize-trivy-version into main 
Reviewed-on: #9
 2026-09-13 03:42:48 +02:00
Philipp e4a0cac9ff refactor: internalize trivy version management and remove input
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 36s
Details
2026-09-13 03:41:34 +02:00
Philipp 48faaf07d1 Merge pull request 'docs: add .git suffix to action url in README example' (#7) from add-write-summary-option into main 
Reviewed-on: #7
 2026-09-13 02:07:30 +02:00
Philipp 1ff782c6c9 Merge branch 'main' into add-write-summary-option
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 40s
Details
2026-09-13 01:24:32 +02:00
Philipp 1b4460f9bd Merge pull request 'Update README.md' (#8) from philipp-patch-1 into main 
Reviewed-on: #8
 2026-09-13 01:23:49 +02:00
Philipp c1dede3ce2 Merge branch 'main' into add-write-summary-option
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 33s
Details
2026-09-13 01:23:36 +02:00
Philipp a62f996eb5 Merge branch 'main' into philipp-patch-1
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 47s
Details
2026-09-13 01:21:44 +02:00
Philipp a513cc2c18 docs: add .git suffix to action url in README example
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 56s
Details
2026-09-13 01:10:44 +02:00
Philipp ed9b1fe7dd Merge pull request 'Update README.md' (#6) from philipp-patch-2 into main 
Reviewed-on: #6
 2026-09-13 01:09:51 +02:00
Philipp e9ec17323b Update README.md
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 2m34s
Details
2026-09-13 01:07:07 +02:00
Philipp f4cf18df70 Merge pull request 'fix(template): remove misconfigurations and secrets sections from markdown.tpl' (#5) from clean-markdown-template into main 
Reviewed-on: #5
 2026-09-13 00:48:12 +02:00
Philipp 5ffb2e9287 Merge branch 'main' into clean-markdown-template
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 33s
Details
2026-09-13 00:47:36 +02:00
Philipp e9d80f8ae7 Merge pull request 'feat: add write-summary option to publish reports to step summary' (#4) from add-write-summary-option into main 
Reviewed-on: #4
 2026-09-13 00:47:24 +02:00
Philipp d4fc8d7b16 docs: shorten usage example in README.md
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 39s
Details
2026-09-13 00:43:30 +02:00
Philipp b3a2f082e1 fix(template): remove misconfigurations and secrets sections from markdown.tpl
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 33s
Details
2026-09-13 00:42:46 +02:00
Philipp f246ae5fcd feat: add write-summary option to publish reports to step summary
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 33s
Details
2026-09-13 00:41:19 +02:00
Philipp 9638e61534 Update README.md
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 52s
Details
2026-09-13 00:37:48 +02:00
Philipp d422a145a5 Merge pull request 'Update README.md' (#3) from philipp-patch-1 into main 
Reviewed-on: #3
 2026-09-13 00:36:23 +02:00
Philipp d54f93a438 Merge branch 'main' into philipp-patch-1
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 36s
Details
2026-09-13 00:35:27 +02:00
Philipp 22c6194d8d Merge pull request 'chore: add MIT license' (#1) from add-mit-license into main 
Reviewed-on: #1
 2026-09-13 00:35:01 +02:00
Philipp 864b74c8c5 Merge branch 'main' into add-mit-license
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 34s
Details
2026-09-13 00:34:15 +02:00
Philipp e00aab2abd Merge pull request 'ci: add pre-commit hook configuration' (#2) from add-pre-commit-config into main 
Reviewed-on: #2
 2026-09-13 00:34:04 +02:00
Philipp 492be5a418 Update README.md
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 8s
Details
2026-09-13 00:33:25 +02:00
Philipp 7e3a4ce7ac ci: add pre-commit hook configuration
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 50s
Details
2026-09-13 00:30:15 +02:00
Philipp 25c69c373b chore: add MIT license
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 8s
Details
2026-09-13 00:28:19 +02:00
Philipp bf996103f5 feat: initial commit of cve-differential action 2026-09-13 00:12:26 +02:00