feat: show Arch column only when multiple architectures are scanned

feat: support dynamic multi-architecture discovery and iteration
2026-09-13 22:01:33 +02:00 · 2026-09-13 21:51:43 +02:00
13 changed files with 101 additions and 819 deletions
@@ -1,111 +0,0 @@
-name: CI Tests
-
-on:
-  push:
-    branches:
-    - main
-  pull_request:
-    branches:
-    - main
-  workflow_dispatch:
-
-jobs:
-  unit-test:
-    name: JS Unit Tests
-    runs-on: k8s
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v7
-
-    - name: Run JS Unit Tests
-      shell: bash
-      run: node --test
-
-  test:
-    name: ${{ matrix.image_set.name }} (sbom=${{ matrix.use_inbuild_sbom }})
-    needs: unit-test
-    runs-on: k8s
-    strategy:
-      fail-fast: false
-      matrix:
-        image_set:
-          # Test 1: Slim images with built-in SBOMs (2 architectures, 15-40 CVEs each)
-        - name: with-inbuild-sbom
-          head_image: debian:bookworm-slim
-          target_image: debian:bullseye-slim
-          architectures: amd64,arm64
-          expect_arch_col: true
-
-          # Test 2: Slim images without built-in SBOMs (1 architecture, 70-120 CVEs each)
-        - name: without-inbuild-sbom
-          head_image: debian:buster-slim
-          target_image: debian:stretch-slim
-          architectures: amd64
-          expect_arch_col: false
-
-          # Test 3: Cross-check (Head has built-in SBOM, Target does not, 15-70 CVEs each)
-        - name: cross-check-mixed-sbom
-          head_image: debian:bookworm-slim
-          target_image: debian:buster-slim
-          architectures: amd64
-          expect_arch_col: false
-
-        use_inbuild_sbom:
-        - 'true'
-        - 'false'
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v7
-
-    - name: Test CVE Differential Action
-      uses: ./
-      with:
-        head-image: ${{ matrix.image_set.head_image }}
-        target-image: ${{ matrix.image_set.target_image }}
-        target-branch: main
-        architectures: ${{ matrix.image_set.architectures }}
-        use-inbuild-sbom: ${{ matrix.use_inbuild_sbom }}
-        output-delta: cve-delta.md
-        output-summary: cve-summary.md
-
-    - name: Verify Report Generation & Content
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        test -s cve-delta.md || (echo "::error::cve-delta.md is empty or missing" && exit 1)
-        test -s cve-summary.md || (echo "::error::cve-summary.md is empty or missing" && exit 1)
-
-        # Verify that each scan produced at least 3 CVE findings
-        cve_count=$(grep -c "CVE-" cve-summary.md || echo 0)
-        echo "Total CVE entries found in summary report: $cve_count"
-        if [ "$cve_count" -lt 3 ]; then
-          echo "::error::Expected at least 3 CVEs in cve-summary.md, found only $cve_count"
-          exit 1
-        fi
-
-        echo "=== Delta Report Preview ==="
-        head -n 25 cve-delta.md
-
-        # Verify architectural column rendering behavior
-        if [ "${{ matrix.image_set.expect_arch_col }}" = "true" ]; then
-          grep -q "| Arch |" cve-delta.md || (echo "::error::Expected Arch column in multi-arch report" && exit 1)
-        else
-          if grep -q "| Arch |" cve-delta.md; then
-            echo "::error::Did not expect Arch column in single-arch report" && exit 1
-          fi
-        fi
-        echo "✅ All assertions passed (including >= 3 CVEs verification)."
-
-    - name: Archive SBOMs and CVE Reports
-      if: always()
-      uses: actions/upload-artifact@v7
-      with:
-        name: sboms-and-reports-${{ matrix.image_set.name }}-inbuild-${{ matrix.use_inbuild_sbom }}
-        path: |
-          sboms/
-          cve-reports/
-          cve-delta.md
-          cve-summary.md
-        if-no-files-found: ignore
@@ -13,4 +13,3 @@ cve-*.json
 cve-delta.md
 cve-summary.md
 node_modules/
-!test/fixtures/**
@@ -7,12 +7,13 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
 ## ✨ Features

 - **Dynamic Multi-Platform Support**: Automatically discovers and scans all architectures present in container images, or iterates over an explicit list of target architectures.
- **Fast Attestation Extraction with Automatic Fallback**: Uses `docker buildx imagetools inspect` to extract platform-specific SBOMs directly from registry manifest indices. If attestations are missing or produce 0 CVE findings (common when third-party generators omit OS qualifiers in SPDX), it automatically falls back to generating SBOMs directly with Trivy per architecture.
+- **Fast Attestation Extraction**: Uses `docker buildx imagetools inspect` to extract platform-specific SBOMs directly from registry manifest indices in seconds without downloading layer blobs.
+- **Graceful Fallbacks**: If SBOM attestations are missing for any platform, automatically falls back to generating SBOMs directly with Trivy per architecture.
 - **Set-Based Differential Analysis**: Categorizes vulnerabilities into:
  - 🔴 **Introduced Vulnerabilities** (newly added in this branch / commit)
  - 🟢 **Fixed Vulnerabilities** (present in target baseline, resolved in this branch)
  - ⚪ **Unchanged Vulnerabilities** (pre-existing in target baseline)
- **Secure & Unit Tested**: Verified Trivy binary downloads against static SHA256 checksum lockfiles, single-step unified caching, and comprehensive native unit tests (`node:test`).
+- **Secure by Default**: Verified Trivy binary downloads against static SHA256 checksum lockfiles and single-step unified caching (binary + vulnerability database).

 ---

@@ -27,7 +28,6 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
 | `output-delta` | Output path for the CVE delta Markdown report | No | `cve-delta.md` |
 | `output-summary` | Output path for the full vulnerability Markdown summary | No | `cve-summary.md` |
 | `write-summary` | Whether to append the generated reports to the job summary (`$GITHUB_STEP_SUMMARY`) | No | `true` |
-| `use-inbuild-sbom` | Whether to inspect and use built-in image SBOM attestations. If false (recommended default), generates SBOMs directly with Trivy for maximum vulnerability fidelity. If true, extracts attestations without pulling layers (faster, but findings reflect binary-package SBOMs without rootfs source-mapping; falls back to Trivy image scan if 0 CVEs detected). | No | `false` |

 ---

@@ -40,46 +40,6 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p

 ---

-## 🔍 Built-in SBOM Attestations vs. Trivy Direct Scanning (Syft vs. Trivy)
-
-This action supports two modes for obtaining SBOMs:
-
-### 1. Direct Image Scanning with Trivy (`use-inbuild-sbom: false` — Default & Recommended)
-By default, the action uses `trivy image --format spdx-json` to generate the SBOM directly from the container images:
- **Full Filesystem Fidelity**: Inspects the entire flattened root filesystem, reading `/etc/os-release` and native package databases (e.g. `/var/lib/dpkg/status`, RPM databases, apk).
- **Accurate OS & Language Package Detection**: Catalogs both OS packages (Debian, Alpine, RHEL, etc.) and application dependencies (Python, Node.js, Go, etc.).
- **Symmetric, Apples-to-Apples Comparisons**: Both `head` and `target` images are analyzed using the identical Trivy engine and vulnerability database, preventing skewed diffs.
-
-### 2. Built-in Attestation Extraction with Resilient Fallback (`use-inbuild-sbom: true`)
-When enabled, the action extracts SBOM attestations attached to the container image using `docker buildx imagetools inspect`:
- **Speed**: Extracts the SBOM JSON metadata directly from the registry manifest index in seconds without pulling image layer blobs.
- **Underlying Generator (Syft / Docker Scout)**: Docker Buildx (`sbom: true`) uses BuildKit's embedded Syft scanner (`moby/buildkit-syft-scanner`).
- **Distro Detection**: Automatically extracts OS distribution information from package PURLs (e.g. `debian/12`) and queries Trivy with `--distro` to accurately identify vulnerabilities on the extracted SBOM.
- **Resilient Fallback**: If an extracted in-build SBOM scan produces 0 CVE findings (a common issue when third-party generators omit OS distribution qualifiers from SPDX packages) or if scanning fails, the action **automatically falls back** to running `trivy image --platform "$platform" --format spdx-json` directly on the image. This guarantees that vulnerability scans never fail silently or report false zeros.
- **Audit Copies**: The action preserves copies of both the raw extracted in-build SBOM (`inbuild-sbom-*.spdx.json`) and the final scanned SBOM (`sbom-*.spdx.json`) for auditing and debugging.
-
-### ⚖️ Trade-offs: Why do the results differ between strategies?
-
-The vulnerability results between Strategy 1 (`sbom: false`) and Strategy 2 (`sbom: true`) are **not identical**:
-
-| Feature / Metric | Direct Trivy Scan (`use-inbuild-sbom: false`) | Built-in Attestation (`use-inbuild-sbom: true`) |
-| :--- | :--- | :--- |
-| **Generator** | Trivy directly on container rootfs | Docker Scout / BuildKit (Syft) |
-| **Execution Speed** | Slower (pulls image layer blobs) | **Very Fast** (~5x faster, 0 layer downloads) |
-| **Debian Slim Findings Example** | **~225 CVEs** (`debian:bookworm-slim`) | **~104 CVEs** (`debian:bookworm-slim`) |
-| **Package Resolution Model** | Source & binary packages (`/var/lib/dpkg/status`) | Binary packages cataloged in SPDX PURLs |
-| **Filesystem Inspection** | Full filesystem (static binaries, libraries) | Manifest-only (packages cataloged at build time) |
-| **Primary Use Case** | **High-fidelity security audits & release gates** | **High-speed PR checks & developer feedback loops** |
-
-#### Why the vulnerability counts differ:
-1. **Debian Source vs. Binary Packages**: Debian security advisories (DSAs / DLAs) are tracked and published per **source package** (e.g., the source package `glibc` produces multiple binary packages like `libc6`, `libc-bin`, `locales`). Trivy's filesystem scanner reads `/var/lib/dpkg/status` to map installed binary packages directly to Debian source package advisories. Syft's default SPDX output catalogs installed binary packages as PURLs without source-package relations, so Trivy's SBOM scan queries only the exact binary package entries that match Debian database schemas without the source-mapping context.
-2. **Filesystem vs. Manifest Scope**: Direct image scanning unpacks and inspects the entire container image filesystem (including file hashes, crypto libraries, and static binaries). An in-build SBOM scan is strictly limited to the package inventory written by the build-time generator.
-
-> [!TIP]
-> Setting `use-inbuild-sbom: 'false'` remains the recommended default for maximum accuracy and cross-platform consistency. If you choose to enable `use-inbuild-sbom: 'true'`, the built-in fallback ensures full coverage even when third-party attestations lack OS package metadata.
-
---
-
 ## 🚀 Usage Example

 ```yaml
@@ -93,6 +53,7 @@ jobs:
        with:
          context: .
          push: true
+          sbom: true
          tags: registry.example.com/my-app:git-${{ github.sha }}

      - name: Compare Vulnerabilities (Head vs Target)
@@ -28,10 +28,6 @@ inputs:
    description: Whether to append the generated reports to the job summary ($GITHUB_STEP_SUMMARY)
    required: false
    default: 'true'
-  use-inbuild-sbom:
-    description: Whether to inspect and use built-in image SBOM attestations. If false (recommended default), generates SBOMs directly with Trivy for maximum vulnerability detection fidelity. If true, extracts attestations without pulling layers (faster, but findings may differ from direct scans due to binary vs source package tracking; falls back to Trivy image scan if 0 CVEs detected).
-    required: false
-    default: 'false'

 outputs:
  delta-report:
@@ -48,13 +44,13 @@ runs:
    id: vars
    shell: bash
    env:
-      TRIVY_VERSION: 0.76.2   # trivy-version
+      TRIVY_VERSION: 0.74.0   # trivy-version
    run: |
      echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
      echo "version=${TRIVY_VERSION}" >> "$GITHUB_OUTPUT"

  - name: Cache Trivy (Binary & Vulnerability DB)
-    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9     # v6.1.0
+    uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830     # v4.3.0
    with:
      path: |
        ~/.cache/trivy-bin
@@ -66,15 +62,14 @@ runs:
  - name: Install and Verify Trivy
    shell: bash
    run: |
-      set -euo pipefail
-
-      mkdir -p "$HOME/.local/bin" "$HOME/.cache/trivy-bin"
+      mkdir -p "$HOME/.cache/trivy-bin" "$HOME/.local/bin"
      echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-      ARCH="$(uname -m)"
-      case "${ARCH}" in
+
+      ARCH=$(uname -m)
+      case "$ARCH" in
        x86_64) T_ARCH="64bit" ;;
        aarch64|arm64) T_ARCH="ARM64" ;;
-        *) echo "::error::Unsupported architecture: ${ARCH}"; exit 1 ;;
+        *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
      esac

      checksums_file="${{ github.action_path }}/checksums.txt"
@@ -95,22 +90,15 @@ runs:
    shell: bash
    run: |
      export PATH="$HOME/.local/bin:$PATH"
-      export TRIVY_SKIP_VERSION_CHECK="true"
      mkdir -p sboms/head sboms/target

      cleanup_file() {
        local f="$1"
-        if [ -f "$f" ]; then
-          if [ ! -s "$f" ] || [ "$(cat "$f" 2>/dev/null)" = "null" ]; then
-            rm -f "$f"
-          fi
+        if [ ! -s "$f" ] || [ "$(cat "$f" 2>/dev/null)" = "null" ]; then
+          rm -f "$f"
        fi
      }

-      head_sbom_err=""
-      target_sbom_err=""
-      use_inbuild="${{ inputs.use-inbuild-sbom }}"
-
      # Determine target platforms / architectures
      PLATFORMS=()
      if [ -n "${{ inputs.architectures }}" ]; then
@@ -158,138 +146,60 @@ runs:
      fi

      echo "Configured platforms: ${PLATFORMS[*]:-(single platform fallback)}"
-      if [ "$use_inbuild" = "true" ]; then
-        echo "ℹ️  Strategy: Built-in SBOM attestation extraction enabled (Docker Scout / Syft). Skips container layer downloads for maximum speed."
-        echo "ℹ️  Note: Built-in SBOM vulnerability counts may differ from direct filesystem scans ('trivy image') due to binary vs. source package tracking."
-      else
-        echo "ℹ️  Strategy: Direct Trivy image scanning enabled (default). Inspects full container rootfs and package databases for maximum fidelity."
-      fi

      for platform in "${PLATFORMS[@]}"; do
        arch_tag=$(echo "$platform" | sed -e 's#^[a-zA-Z0-9_-]*/##' -e 's#/#-#g')

        # Head image extraction & fallback
-        if [ "$use_inbuild" = "true" ]; then
-          echo "Attempting extraction of built-in SBOM for head image ($platform)..."
-          docker buildx imagetools inspect "${{ inputs.head-image }}" \
-            --format "{{ json (index .SBOM \"${platform}\").SPDX }}" > "sboms/head/sbom-${arch_tag}.spdx.json" 2>/dev/null || true
-          cleanup_file "sboms/head/sbom-${arch_tag}.spdx.json"
-          [ -f "sboms/head/sbom-${arch_tag}.spdx.json" ] && cp "sboms/head/sbom-${arch_tag}.spdx.json" "sboms/head/inbuild-sbom-${arch_tag}.spdx.json" 2>/dev/null || true
-        fi
+        echo "Extracting SBOM for head image ($platform)..."
+        docker buildx imagetools inspect "${{ inputs.head-image }}" \
+          --format "{{ json (index .SBOM \"${platform}\").SPDX }}" > "sboms/head/sbom-${arch_tag}.spdx.json" 2>/dev/null || true
+        cleanup_file "sboms/head/sbom-${arch_tag}.spdx.json"

        if [ ! -f "sboms/head/sbom-${arch_tag}.spdx.json" ]; then
-          echo "Generating SBOM for head image ($platform) with Trivy..."
-          if ! trivy image --skip-version-check --platform "$platform" --format spdx-json --output "sboms/head/sbom-${arch_tag}.spdx.json" "${{ inputs.head-image }}"; then
-            echo "::warning::Trivy image scan failed for head image ($platform)"
-          fi
+          echo "Head image lacks SBOM attestation for $platform; generating with Trivy..."
+          trivy image --platform "$platform" --format spdx-json --output "sboms/head/sbom-${arch_tag}.spdx.json" "${{ inputs.head-image }}" || true
          cleanup_file "sboms/head/sbom-${arch_tag}.spdx.json"
        fi

        # Target image extraction & fallback
-        if [ "$use_inbuild" = "true" ]; then
-          echo "Attempting extraction of built-in SBOM for target image ($platform)..."
-          docker buildx imagetools inspect "${{ inputs.target-image }}" \
-            --format "{{ json (index .SBOM \"${platform}\").SPDX }}" > "sboms/target/sbom-${arch_tag}.spdx.json" 2>/dev/null || true
-          cleanup_file "sboms/target/sbom-${arch_tag}.spdx.json"
-          [ -f "sboms/target/sbom-${arch_tag}.spdx.json" ] && cp "sboms/target/sbom-${arch_tag}.spdx.json" "sboms/target/inbuild-sbom-${arch_tag}.spdx.json" 2>/dev/null || true
-        fi
+        echo "Extracting SBOM for target image ($platform)..."
+        docker buildx imagetools inspect "${{ inputs.target-image }}" \
+          --format "{{ json (index .SBOM \"${platform}\").SPDX }}" > "sboms/target/sbom-${arch_tag}.spdx.json" 2>/dev/null || true
+        cleanup_file "sboms/target/sbom-${arch_tag}.spdx.json"

        if [ ! -f "sboms/target/sbom-${arch_tag}.spdx.json" ]; then
-          echo "Generating SBOM for target image ($platform) with Trivy..."
-          if ! trivy image --skip-version-check --platform "$platform" --format spdx-json --output "sboms/target/sbom-${arch_tag}.spdx.json" "${{ inputs.target-image }}"; then
-            echo "::warning::Trivy image scan failed for target image ($platform)"
-          fi
+          echo "Target image lacks SBOM attestation for $platform; generating with Trivy..."
+          trivy image --platform "$platform" --format spdx-json --output "sboms/target/sbom-${arch_tag}.spdx.json" "${{ inputs.target-image }}" || true
          cleanup_file "sboms/target/sbom-${arch_tag}.spdx.json"
        fi
      done

      # Fallbacks if no platform-specific SBOMs were extracted (e.g. single-arch image without index)
      if [ -z "$(find sboms/head -type f -name 'sbom-*.spdx.json' 2>/dev/null)" ]; then
-        if [ "$use_inbuild" = "true" ]; then
-          docker buildx imagetools inspect "${{ inputs.head-image }}" \
-            --format '{{ json .SBOM.SPDX }}' > sboms/head/sbom-default.spdx.json 2>/dev/null || true
-          cleanup_file sboms/head/sbom-default.spdx.json
-          [ -f sboms/head/sbom-default.spdx.json ] && cp sboms/head/sbom-default.spdx.json sboms/head/inbuild-sbom-default.spdx.json 2>/dev/null || true
-        fi
+        echo "Extracting root SBOM or scanning head image directly..."
+        docker buildx imagetools inspect "${{ inputs.head-image }}" \
+          --format '{{ json .SBOM.SPDX }}' > sboms/head/sbom-default.spdx.json 2>/dev/null || true
+        cleanup_file sboms/head/sbom-default.spdx.json

        if [ ! -f sboms/head/sbom-default.spdx.json ]; then
-          echo "Generating default head SBOM directly with Trivy..."
-          if ! trivy image --skip-version-check --format spdx-json --output sboms/head/sbom-default.spdx.json "${{ inputs.head-image }}"; then
-            head_sbom_err="Failed to generate SBOM with Trivy for head image"
-          fi
+          trivy image --format spdx-json --output sboms/head/sbom-default.spdx.json "${{ inputs.head-image }}" || true
          cleanup_file sboms/head/sbom-default.spdx.json
        fi
      fi

      if [ -z "$(find sboms/target -type f -name 'sbom-*.spdx.json' 2>/dev/null)" ]; then
-        if [ "$use_inbuild" = "true" ]; then
-          docker buildx imagetools inspect "${{ inputs.target-image }}" \
-            --format '{{ json .SBOM.SPDX }}' > sboms/target/sbom-default.spdx.json 2>/dev/null || true
-          cleanup_file sboms/target/sbom-default.spdx.json
-          [ -f sboms/target/sbom-default.spdx.json ] && cp sboms/target/sbom-default.spdx.json sboms/target/inbuild-sbom-default.spdx.json 2>/dev/null || true
-        fi
+        echo "Extracting root SBOM or scanning target image directly..."
+        docker buildx imagetools inspect "${{ inputs.target-image }}" \
+          --format '{{ json .SBOM.SPDX }}' > sboms/target/sbom-default.spdx.json 2>/dev/null || true
+        cleanup_file sboms/target/sbom-default.spdx.json

        if [ ! -f sboms/target/sbom-default.spdx.json ]; then
-          echo "Generating default target SBOM directly with Trivy..."
-          if ! trivy image --skip-version-check --format spdx-json --output sboms/target/sbom-default.spdx.json "${{ inputs.target-image }}"; then
-            target_sbom_err="Failed to generate SBOM with Trivy for target image"
-          fi
+          trivy image --format spdx-json --output sboms/target/sbom-default.spdx.json "${{ inputs.target-image }}" || true
          cleanup_file sboms/target/sbom-default.spdx.json
        fi
      fi

-      shopt -s nullglob
-      head_files=(sboms/head/sbom-*.spdx.json)
-      target_files=(sboms/target/sbom-*.spdx.json)
-
-      if [ ${#head_files[@]} -eq 0 ] && [ -z "$head_sbom_err" ]; then
-        head_sbom_err="No SBOM generated and head image could not be inspected"
-      fi
-
-      if [ ${#target_files[@]} -eq 0 ] && [ -z "$target_sbom_err" ]; then
-        target_sbom_err="No SBOM generated and target baseline image could not be inspected"
-      fi
-
-      # Diagnostic overview
-      echo ""
-      echo "================================================================================"
-      echo "                      SBOM EXTRACTION DIAGNOSTIC OVERVIEW                       "
-      echo "================================================================================"
-      if [ -n "$head_sbom_err" ]; then
-        echo "HEAD Image (${{ inputs.head-image }}): ❌ FAILED - $head_sbom_err"
-      else
-        echo "HEAD Image (${{ inputs.head-image }}): ✅ SUCCESS"
-        for f in "${head_files[@]}"; do
-          echo "  - $(basename "$f") ($(wc -c < "$f") bytes)"
-        done
-      fi
-
-      if [ -n "$target_sbom_err" ]; then
-        echo "TARGET Baseline Image (${{ inputs.target-image }}): ❌ FAILED - $target_sbom_err"
-      else
-        echo "TARGET Baseline Image (${{ inputs.target-image }}): ✅ SUCCESS"
-        for f in "${target_files[@]}"; do
-          echo "  - $(basename "$f") ($(wc -c < "$f") bytes)"
-        done
-      fi
-      echo "================================================================================"
-      echo ""
-
-      has_sbom_err=false
-      if [ -n "$head_sbom_err" ]; then
-        echo "::error::Head SBOM extraction failed: $head_sbom_err"
-        has_sbom_err=true
-      fi
-      if [ -n "$target_sbom_err" ]; then
-        echo "::error::Target baseline SBOM extraction failed: $target_sbom_err"
-        has_sbom_err=true
-      fi
-
-      if [ "$has_sbom_err" = "true" ]; then
-        echo "::error::Both head and target images must have valid SBOMs to proceed with differential scanning."
-        exit 1
-      fi
-
      # Expose extracted head SBOMs to workspace root for workflow artifact uploads
      for f in sboms/head/sbom-*.spdx.json; do
        [ -f "$f" ] || continue
@@ -300,245 +210,30 @@ runs:
    shell: bash
    run: |
      export PATH="$HOME/.local/bin:$PATH"
-      export TRIVY_SKIP_VERSION_CHECK="true"
      mkdir -p cve-reports/head cve-reports/target

-      shopt -s nullglob
-      head_sboms=(sboms/head/sbom-*.spdx.json)
-      target_sboms=(sboms/target/sbom-*.spdx.json)
-
-      head_ok=true
-      target_ok=true
-      head_report_count=0
-      target_report_count=0
-
-      head_summary=()
-      target_summary=()
-      use_inbuild="${{ inputs.use-inbuild-sbom }}"
-
-      detect_distro() {
-        node -e '
-          const fs = require("fs");
-          try {
-            const data = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
-            let name, ver;
-            for (const pkg of (data.packages || [])) {
-              for (const ref of (pkg.externalRefs || [])) {
-                if (ref.referenceType === "purl" && ref.referenceLocator) {
-                  const mName = ref.referenceLocator.match(/[?&]os_name=([^&]+)/);
-                  const mVer = ref.referenceLocator.match(/[?&]os_version=([^&]+)/);
-                  if (mName && mVer) {
-                    name = mName[1];
-                    ver = mVer[1];
-                    break;
-                  }
-                }
-              }
-              if (name && ver) break;
-            }
-            if (name && ver) console.log(name + "/" + ver);
-          } catch (e) {}
-        ' "$1" 2>/dev/null || true
-      }
-
-      # 1. Scan Head SBOMs
-      if [ ${#head_sboms[@]} -eq 0 ]; then
-        head_ok=false
-        head_summary+=("  - ❌ No SBOM files found in sboms/head/")
-      else
-        for f in "${head_sboms[@]}"; do
-          arch=$(basename "$f" .spdx.json | sed 's/sbom-//')
-          out_json="cve-reports/head/cve-${arch}.json"
-          err_log="cve-reports/head/cve-${arch}.err"
-
-          echo "Scanning head SBOM for architecture: $arch"
-          distro_arg=""
-          if [ "$use_inbuild" = "true" ]; then
-            detected_distro=$(detect_distro "$f")
-            if [ -n "$detected_distro" ]; then
-              echo "Detected distribution '${detected_distro}' from in-build SBOM PURLs. Scanning with --distro."
-              distro_arg="--distro ${detected_distro}"
-            fi
-          fi
-
-          scan_success=false
-          if trivy sbom $distro_arg --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
-            scan_success=true
-          fi
-
-          vuln_cnt=0
-          if [ -s "$out_json" ]; then
-            cnt=$(grep -c '"VulnerabilityID"' "$out_json" 2>/dev/null || true)
-            cnt=$(echo "$cnt" | tr -d '[:space:]')
-            [ -n "$cnt" ] && vuln_cnt="$cnt"
-          fi
-
-          # Fallback if in-build SBOM scan produced 0 CVEs (e.g. incompatible third-party format) or scan failed
-          if [ "$use_inbuild" = "true" ] && { [ "$scan_success" != "true" ] || [ "$vuln_cnt" -eq 0 ]; }; then
-            echo "::warning::In-build SBOM for head image (${arch}) yielded ${vuln_cnt} CVE findings. Falling back to direct Trivy image scan..."
-            t_plat="linux/${arch}"
-            [ "$arch" = "default" ] && t_plat=""
-            plat_arg=""
-            [ -n "$t_plat" ] && plat_arg="--platform $t_plat"
-            if trivy image --skip-version-check $plat_arg --format spdx-json --output "$f" "${{ inputs.head-image }}"; then
-              echo "Re-scanning head SBOM generated directly by Trivy..."
-              if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
-                scan_success=true
-                if [ -s "$out_json" ]; then
-                  cnt=$(grep -c '"VulnerabilityID"' "$out_json" 2>/dev/null || true)
-                  cnt=$(echo "$cnt" | tr -d '[:space:]')
-                  [ -n "$cnt" ] && vuln_cnt="$cnt"
-                fi
-              fi
-            fi
-          fi
-
-          if [ "$scan_success" = "true" ]; then
-            if [ -s "$out_json" ]; then
-              if [ "$vuln_cnt" -eq 0 ]; then
-                echo "::warning::Head image architecture '${arch}' has 0 CVE findings. Verify that OS/packages were recognized."
-                head_summary+=("  - ${arch}: ⚠️ WARNING (0 vulnerability findings detected)")
-              else
-                head_summary+=("  - ${arch}: ✅ OK (${vuln_cnt} vulnerability findings)")
-              fi
-              head_report_count=$((head_report_count + 1))
-            else
-              head_ok=false
-              head_summary+=("  - ${arch}: ❌ FAILED (Output report was empty / 0 bytes)")
-            fi
-          else
-            head_ok=false
-            err_msg=$(tail -n 2 "$err_log" | tr '\n' ' ' | sed 's/  */ /g')
-            [ -z "$err_msg" ] && err_msg="Trivy scan exited with non-zero status"
-            head_summary+=("  - ${arch}: ❌ FAILED (${err_msg})")
-          fi
-        done
-      fi
-
-      # 2. Scan Target SBOMs
-      if [ ${#target_sboms[@]} -eq 0 ]; then
-        target_ok=false
-        target_summary+=("  - ❌ No SBOM files found in sboms/target/")
-      else
-        for f in "${target_sboms[@]}"; do
-          arch=$(basename "$f" .spdx.json | sed 's/sbom-//')
-          out_json="cve-reports/target/cve-${arch}.json"
-          err_log="cve-reports/target/cve-${arch}.err"
-
-          echo "Scanning target SBOM for architecture: $arch"
-          distro_arg=""
-          if [ "$use_inbuild" = "true" ]; then
-            detected_distro=$(detect_distro "$f")
-            if [ -n "$detected_distro" ]; then
-              echo "Detected distribution '${detected_distro}' from in-build SBOM PURLs. Scanning with --distro."
-              distro_arg="--distro ${detected_distro}"
-            fi
-          fi
-
-          scan_success=false
-          if trivy sbom $distro_arg --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
-            scan_success=true
-          fi
-
-          vuln_cnt=0
-          if [ -s "$out_json" ]; then
-            cnt=$(grep -c '"VulnerabilityID"' "$out_json" 2>/dev/null || true)
-            cnt=$(echo "$cnt" | tr -d '[:space:]')
-            [ -n "$cnt" ] && vuln_cnt="$cnt"
-          fi
-
-          # Fallback if in-build SBOM scan produced 0 CVEs (e.g. incompatible third-party format) or scan failed
-          if [ "$use_inbuild" = "true" ] && { [ "$scan_success" != "true" ] || [ "$vuln_cnt" -eq 0 ]; }; then
-            echo "::warning::In-build SBOM for target image (${arch}) yielded ${vuln_cnt} CVE findings. Falling back to direct Trivy image scan..."
-            t_plat="linux/${arch}"
-            [ "$arch" = "default" ] && t_plat=""
-            plat_arg=""
-            [ -n "$t_plat" ] && plat_arg="--platform $t_plat"
-            if trivy image --skip-version-check $plat_arg --format spdx-json --output "$f" "${{ inputs.target-image }}"; then
-              echo "Re-scanning target SBOM generated directly by Trivy..."
-              if trivy sbom --skip-version-check --format json --output "$out_json" "$f" 2>"$err_log"; then
-                scan_success=true
-                if [ -s "$out_json" ]; then
-                  cnt=$(grep -c '"VulnerabilityID"' "$out_json" 2>/dev/null || true)
-                  cnt=$(echo "$cnt" | tr -d '[:space:]')
-                  [ -n "$cnt" ] && vuln_cnt="$cnt"
-                fi
-              fi
-            fi
-          fi
-
-          if [ "$scan_success" = "true" ]; then
-            if [ -s "$out_json" ]; then
-              if [ "$vuln_cnt" -eq 0 ]; then
-                echo "::warning::Target baseline image architecture '${arch}' has 0 CVE findings. Verify that OS/packages were recognized."
-                target_summary+=("  - ${arch}: ⚠️ WARNING (0 vulnerability findings detected)")
-              else
-                target_summary+=("  - ${arch}: ✅ OK (${vuln_cnt} vulnerability findings)")
-              fi
-              target_report_count=$((target_report_count + 1))
-            else
-              target_ok=false
-              target_summary+=("  - ${arch}: ❌ FAILED (Output report was empty / 0 bytes)")
-            fi
-          else
-            target_ok=false
-            err_msg=$(tail -n 2 "$err_log" | tr '\n' ' ' | sed 's/  */ /g')
-            [ -z "$err_msg" ] && err_msg="Trivy scan exited with non-zero status"
-            target_summary+=("  - ${arch}: ❌ FAILED (${err_msg})")
-          fi
-        done
-      fi
-
-      # 3. Print Comprehensive Diagnostic Overview
-      echo ""
-      echo "================================================================================"
-      echo "                   CVE VULNERABILITY SCAN DIAGNOSTIC OVERVIEW                  "
-      echo "================================================================================"
-      if [ "$use_inbuild" = "true" ]; then
-        echo "Scan Strategy: Built-in OCI Attestation (Syft/Docker Scout) with distro detection"
-      else
-        echo "Scan Strategy: Direct Trivy Image Scan (Full rootfs & source package mapping)"
-      fi
-      echo "--------------------------------------------------------------------------------"
-      echo "HEAD Image: ${{ inputs.head-image }}"
-      for line in "${head_summary[@]}"; do
-        echo "$line"
+      # Scan each available head SBOM
+      for f in sboms/head/sbom-*.spdx.json; do
+        [ -f "$f" ] || continue
+        arch=$(basename "$f" .spdx.json | sed 's/sbom-//')
+        echo "Scanning head SBOM for architecture: $arch"
+        trivy sbom --format json --output "cve-reports/head/cve-${arch}.json" "$f" || true
      done
-      echo ""
-      echo "TARGET Baseline Image: ${{ inputs.target-image }} (branch: '${{ inputs.target-branch }}')"
-      for line in "${target_summary[@]}"; do
-        echo "$line"
+
+      # Scan each available target SBOM
+      for f in sboms/target/sbom-*.spdx.json; do
+        [ -f "$f" ] || continue
+        arch=$(basename "$f" .spdx.json | sed 's/sbom-//')
+        echo "Scanning target SBOM for architecture: $arch"
+        trivy sbom --format json --output "cve-reports/target/cve-${arch}.json" "$f" || true
      done
-      echo "================================================================================"
-      echo ""

-      # 4. Enforce Gating: Both must have succeeded with valid reports
-      has_error=false
-      if [ "$head_ok" != "true" ] || [ "$head_report_count" -eq 0 ]; then
-        echo "::error::Head image CVE analysis failed or produced no reports."
-        has_error=true
-      fi
-
-      if [ "$target_ok" != "true" ] || [ "$target_report_count" -eq 0 ]; then
-        echo "::error::Target baseline CVE analysis failed or produced no reports."
-        has_error=true
-      fi
-
-      if [ "$has_error" = "true" ]; then
-        echo "::error::Aborting differential analysis: both head and target scans must succeed before diffing."
-        exit 1
-      fi
-
-      # 5. Run multi-arch set-based diff and generate consolidated full summary report
-      echo "Both head and target scans succeeded. Computing set-based vulnerability delta..."
-      if ! node "${{ github.action_path }}/cve-diff.js" \
+      # Run multi-arch set-based diff and generate consolidated full summary report
+      node "${{ github.action_path }}/cve-diff.js" \
        "cve-reports/target" \
        "cve-reports/head" \
        "${{ inputs.target-branch }}" \
-        "${{ inputs.output-summary }}" > "${{ inputs.output-delta }}"; then
-        echo "::error::Failed to generate CVE differential report"
-        exit 1
-      fi
+        "${{ inputs.output-summary }}" > "${{ inputs.output-delta }}" || true

  - name: Publish Reports to Step Summary
    shell: bash
@@ -1,22 +1,22 @@
-89c88a41cc259cb93951a4fc923fbeee145302c369cc098b2af56298569cfa06  trivy_0.75.0_FreeBSD-64bit.tar.gz
-21e1b4cfadfd4c975ee95c77b03c3ef3ffa8de732cbaf45b729e3bd5a59a4c67  trivy_0.75.0_Linux-32bit.deb
-b617436b0b55c04f58f1f654ba80e98f1063d21ceaff2cc192f830bacb1d0aba  trivy_0.75.0_Linux-32bit.rpm
-5dca0e5b0579a1c5fff1bf7dc541185020a3df892fe7c3345a1bf22988cc0e9c  trivy_0.75.0_Linux-32bit.tar.gz
-b6d7b944b6cbf4e7de5b4bc6c3635900c50fed53b64b77b99a5fbc3136cd1d5d  trivy_0.75.0_Linux-64bit.deb
-fba2b73579645839892dfd7b94c5551983f0f094ff88efc94a69383de00a1f26  trivy_0.75.0_Linux-64bit.rpm
-c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f  trivy_0.75.0_Linux-64bit.tar.gz
-6d35e18b2f09c3f389c5cf94f0f259c5320debf1ce16c37f010d9a8ca1bec88f  trivy_0.75.0_Linux-ARM.deb
-a39a931e5b88050892e9811f843e0c05e29c73c03bac4afffc7508a45b215dff  trivy_0.75.0_Linux-ARM.rpm
-8cbe2286600ba56267fab0f10cf5696c252993b7b7935c5cef518abab3c84af4  trivy_0.75.0_Linux-ARM.tar.gz
-23018f1f7136b8391bb300e2579bcf4759e3c64012856f51c0fb6fffe1ee3841  trivy_0.75.0_Linux-ARM64.deb
-a28a78b82c06049d3b1d8c4b17ddb4586357ccf8e4b0aa1b30d0867beb3b11a0  trivy_0.75.0_Linux-ARM64.rpm
-a1ee9f6ffb7d112b64ff726a2a0717c21175c1114361391f4a132956751a13b3  trivy_0.75.0_Linux-ARM64.tar.gz
-eed0d48c91904036a1c039c3c8c1c2b13eee8983b101c371dbe49c9ae24d8e01  trivy_0.75.0_Linux-PPC64LE.deb
-cfefab190d7d972735ed372ec32e5adda6af30ff24d7e0669bfd0eac9a15a1b5  trivy_0.75.0_Linux-PPC64LE.rpm
-dbd7403d4191b14efd5ee4a808c93bc97b56fa9f62dd98a691a61bf6e556642e  trivy_0.75.0_Linux-PPC64LE.tar.gz
-f440ffa772be9d517f5e03b93bfe99035bc28dd760d841877c5994259481c94a  trivy_0.75.0_Linux-s390x.deb
-c1269d4af420a69e81cb0b7cf234728db5bfe6ecc350c78f5f3bbfd0be1c228c  trivy_0.75.0_Linux-s390x.rpm
-6acd3a3af4688567f5d3cdf3dd45e871ae060a88c07cea01401ae1487c4f19a3  trivy_0.75.0_Linux-s390x.tar.gz
-291edaa9778acbe4693d067b5ad60ee11570e5ac68296e85595417528ca641e4  trivy_0.75.0_macOS-64bit.tar.gz
-4a77108cccf8e55c8d6823e1e759939a622277e66cd0daa3c1fc621ed69e4568  trivy_0.75.0_macOS-ARM64.tar.gz
-4e43bd71a30f51aee39525f60f2b47043af77eb8df8fe082aae4372b69c6660f  trivy_0.75.0_windows-64bit.zip
+b8e8834a90b0f28c172498a96d1b91876eb2f09867f02aa314df9a862aa86227  trivy_0.74.0_FreeBSD-64bit.tar.gz
+cea47f6624cab9123a6bebc2f6586f3f82b8cd3165fc0ecd21677ba8a4ca0f5c  trivy_0.74.0_Linux-32bit.deb
+bec3a7aed02d60b6bb2996bb63897f604464c2db0b2b29dfc3cc7ce9959c8aaf  trivy_0.74.0_Linux-32bit.rpm
+048af0c9597a8e275f60bb9e0543748dbc76e22bdd52456b84ea0fa0cd2a078a  trivy_0.74.0_Linux-32bit.tar.gz
+cf1e32ec8d4d8823e023096a28cadb14f5b5123ce03f201fb633c5b76aa712dd  trivy_0.74.0_Linux-64bit.deb
+2331b82ec0ce5529a09fad8ccbfe03987ec9277ff4fbd6e96c6cb0aff8103477  trivy_0.74.0_Linux-64bit.rpm
+2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a  trivy_0.74.0_Linux-64bit.tar.gz
+5665eaa443bfb117c5c4c373254f0ba9e2888985e6233588ce98bb0960f558c3  trivy_0.74.0_Linux-ARM.deb
+bdd73ea298ec538ffae3351614a3adefc8c48599fce7943e6376fcfa040c0e85  trivy_0.74.0_Linux-ARM.rpm
+99adbe319fa685cb4bff04dd0077e31cb94828338cab5db7f78fe6dcecca8ec1  trivy_0.74.0_Linux-ARM.tar.gz
+14fae2604eab589fd544224ef56b8b8a44266872c43b259bd36cfde81428acc8  trivy_0.74.0_Linux-ARM64.deb
+bb753f2dacd22417ac7709fdd910a0b017f4bb43330eac8b51c2a90403ae2fd3  trivy_0.74.0_Linux-ARM64.rpm
+b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5  trivy_0.74.0_Linux-ARM64.tar.gz
+16a1e36b6d405951b36f1e4b31bb7655f8551f1581934fcb2e6e5bdf8c46f6c9  trivy_0.74.0_Linux-PPC64LE.deb
+cc7183af95dbab1ae1400fca17b35ca8f9591676a1042144994698cad9cac5a6  trivy_0.74.0_Linux-PPC64LE.rpm
+c5aabfe8789d0d43f578ef2d01174884c8ff0f2106c627a220a43f7bf9054959  trivy_0.74.0_Linux-PPC64LE.tar.gz
+f8fe56cee9a502e82f05e45465943e3bc6e75de05530ffc7bddf93e65b0de5bb  trivy_0.74.0_Linux-s390x.deb
+4fb2d5bd1ab5e61917e73cd2936daeae1c5ab9af024321a222437d824bac5579  trivy_0.74.0_Linux-s390x.rpm
+516cfe38eaede79c178088265657aad12be6c155271ac68ff728a141961ef197  trivy_0.74.0_Linux-s390x.tar.gz
+472816f6888dda689d075c30254d4210b4d1035acf365aa72332f584c2f60485  trivy_0.74.0_macOS-64bit.tar.gz
+1caada5e0e2091909357c7525d3aa76f4b660b13821bc143b190c7483e31cc11  trivy_0.74.0_macOS-ARM64.tar.gz
+94c40e0696e4b907a74b7b2e1438d5d72ebaca83115817407f568a002d520842  trivy_0.74.0_windows-64bit.zip
@@ -42,24 +42,14 @@ function loadReportsForArg(arg) {
    }
  }

-  if (filePaths.length === 0) {
-    console.error(`::error::No CVE JSON report files found for path: ${arg}`);
-    process.exit(1);
-  }
-
-  let loadedFiles = 0;
  for (const filePath of filePaths) {
    let stat;
    try {
      stat = fs.statSync(filePath);
-    } catch (e) {
-      console.error(`::error::Failed to access report file ${filePath}: ${e.message}`);
-      process.exit(1);
-    }
-    if (stat.size === 0) {
-      console.error(`::error::CVE report file is empty (0 bytes): ${filePath}`);
-      process.exit(1);
+    } catch {
+      continue;
    }
+    if (stat.size === 0) continue;

    const baseName = path.basename(filePath, '.json').toLowerCase();
    let arch = 'all';
@@ -79,20 +69,15 @@ function loadReportsForArg(arg) {
    try {
      const content = fs.readFileSync(filePath, 'utf8');
      data = JSON.parse(content);
-    } catch (e) {
-      console.error(`::error::Invalid JSON in CVE report file ${filePath}: ${e.message}`);
-      process.exit(1);
+    } catch {
+      continue;
    }

-    if (!data || typeof data !== 'object') {
-      console.error(`::error::Malformed Trivy report structure in: ${filePath}`);
-      process.exit(1);
+    if (!data || typeof data !== 'object' || !Array.isArray(data.Results)) {
+      continue;
    }

-    const results = Array.isArray(data.Results) ? data.Results : [];
-    loadedFiles++;
-
-    for (const result of results) {
+    for (const result of data.Results) {
      const target = result.Target || result.Type || 'App';
      const vulns = Array.isArray(result.Vulnerabilities) ? result.Vulnerabilities : [];
      for (const v of vulns) {
@@ -110,11 +95,6 @@ function loadReportsForArg(arg) {
    }
  }

-  if (loadedFiles === 0) {
-    console.error(`::error::No valid CVE reports could be loaded for path: ${arg}`);
-    process.exit(1);
-  }
-
  cves.scannedArchs = scannedArchs;
  return cves;
 }
@@ -136,7 +116,7 @@ function formatVulnRow(v, allScannedArchs = new Set(), showArch = true) {

  const installed = v.InstalledVersion || '-';
  const fixed = v.FixedVersion || '-';
-  let title = (v.Title || v.Description || '').replace(/\n/g, ' ').replace(/\|/g, '\\|').trim();
+  let title = (v.Title || v.Description || '').replace(/\n/g, ' ').trim();
  if (title.length > 80) {
    title = title.slice(0, 77) + '...';
  }
@@ -167,17 +147,19 @@ function formatVulnRow(v, allScannedArchs = new Set(), showArch = true) {
 * @returns {string}
 */
 function renderMarkdownDiff(baseCves, branchCves, baseName = 'main') {
+  if (baseCves.size === 0) {
+    return [
+      `### 🔄 Vulnerability Delta (vs \`${baseName}\`)`,
+      '',
+      '> [!NOTE]',
+      `> No baseline scan from \`${baseName}\` was available to compare against.`,
+      '',
+    ].join('\n');
+  }
+
  const baseKeys = new Set(baseCves.keys());
  const branchKeys = new Set(branchCves.keys());

-  if (branchCves.size === 0) {
-    console.error('::warning::Head image contains 0 reported vulnerabilities. Verify that packages and dependencies were recognized.');
-  }
-
-  if (baseCves.size === 0) {
-    console.error(`::warning::Baseline target (${baseName}) contains 0 reported vulnerabilities.`);
-  }
-
  const newKeys = [];
  let unchangedCount = 0;
  for (const key of branchKeys) {
@@ -218,30 +200,15 @@ function renderMarkdownDiff(baseCves, branchCves, baseName = 'main') {
  const lines = [
    `### 🔄 Vulnerability Delta (vs \`${baseName}\`)`,
    '',
+    '| Metric | Count |',
+    '| :--- | :--- |',
+    `| 🚨 **New Vulnerabilities** | ${newVulns.length > 0 ? `🚨 **${newVulns.length}**` : '0'} |`,
+    `| ✅ **Resolved Vulnerabilities** | ${resolvedVulns.length > 0 ? `✅ **${resolvedVulns.length}**` : '0'} |`,
+    `| ⚪ **Unchanged Vulnerabilities** | ${unchangedCount} |`,
+    '',
+    `#### 🚨 New Vulnerabilities Introduced (${newVulns.length})`,
  ];

-  if (branchCves.size === 0 && baseCves.size === 0) {
-    lines.push('> [!WARNING]');
-    lines.push('> Both the head image and baseline target have **0 reported vulnerabilities**.');
-    lines.push('');
-  } else if (branchCves.size === 0) {
-    lines.push('> [!WARNING]');
-    lines.push('> The head image has **0 reported vulnerabilities**. Verify that OS packages and language dependencies were properly indexed in the SBOM.');
-    lines.push('');
-  } else if (baseCves.size === 0) {
-    lines.push('> [!WARNING]');
-    lines.push(`> The baseline image (\`${baseName}\`) has **0 reported vulnerabilities**.`);
-    lines.push('');
-  }
-
-  lines.push('| Metric | Count |');
-  lines.push('| :--- | :--- |');
-  lines.push(`| 🚨 **New Vulnerabilities** | ${newVulns.length > 0 ? `🚨 **${newVulns.length}**` : '0'} |`);
-  lines.push(`| ✅ **Resolved Vulnerabilities** | ${resolvedVulns.length > 0 ? `✅ **${resolvedVulns.length}**` : '0'} |`);
-  lines.push(`| ⚪ **Unchanged Vulnerabilities** | ${unchangedCount} |`);
-  lines.push('');
-  lines.push(`#### 🚨 New Vulnerabilities Introduced (${newVulns.length})`);
-
  if (newVulns.length > 0) {
    if (showArch) {
      lines.push('| Severity | CVE | Package | Arch | Installed | Fixed In | Title |');
@@ -6,8 +6,8 @@
  "customManagers": [
    {
      "customType": "regex",
-      "managerFilePatterns": [
-        "/^action\\.ya?ml$/"
+      "fileMatch": [
+        "^action\\.ya?ml$"
      ],
      "matchStrings": [
        "TRIVY_VERSION:\\s*(?<currentValue>[0-9]+\\.[0-9]+\\.[0-9]+)\\s*#\\s*trivy-version"
@@ -1,111 +0,0 @@
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const path = require('node:path');
-const {
-  loadReportsForArg,
-  formatVulnRow,
-  renderMarkdownDiff,
-  renderFullSummary,
-} = require('../cve-diff.js');
-
-const FIXTURES_DIR = path.join(__dirname, 'fixtures');
-
-test('loadReportsForArg loads valid reports and extracts multi-arch metadata', () => {
-  const targetDir = path.join(FIXTURES_DIR, 'target');
-  const cves = loadReportsForArg(targetDir);
-
-  assert.equal(cves.size, 2);
-  assert.ok(cves.has('CVE-2023-0001:::glibc'));
-  assert.ok(cves.has('CVE-2023-0002:::openssl'));
-
-  const glibc = cves.get('CVE-2023-0001:::glibc');
-  assert.equal(glibc.Severity, 'CRITICAL');
-  assert.deepEqual(Array.from(glibc._archs).sort(), ['amd64', 'arm64']);
-  assert.deepEqual(Array.from(cves.scannedArchs).sort(), ['amd64', 'arm64']);
-
-  const openssl = cves.get('CVE-2023-0002:::openssl');
-  assert.equal(openssl.Severity, 'HIGH');
-  assert.deepEqual(Array.from(openssl._archs), ['amd64']);
-});
-
-test('loadReportsForArg handles reports with missing or null Results array without crashing', () => {
-  const emptyDir = path.join(FIXTURES_DIR, 'empty');
-  const cves = loadReportsForArg(emptyDir);
-
-  assert.equal(cves.size, 0);
-});
-
-test('renderMarkdownDiff produces correct introduced, resolved, and unchanged sets', () => {
-  const targetDir = path.join(FIXTURES_DIR, 'target');
-  const headDir = path.join(FIXTURES_DIR, 'head');
-
-  const baseCves = loadReportsForArg(targetDir);
-  const branchCves = loadReportsForArg(headDir);
-
-  const diff = renderMarkdownDiff(baseCves, branchCves, 'main');
-
-  // Introduced: CVE-2023-0003 (curl)
-  assert.ok(diff.includes('New Vulnerabilities Introduced (1)'));
-  assert.ok(diff.includes('CVE-2023-0003'));
-  assert.ok(diff.includes('`curl`'));
-
-  // Resolved: CVE-2023-0001 (glibc)
-  assert.ok(diff.includes('Resolved / Removed Vulnerabilities (1)'));
-  assert.ok(diff.includes('CVE-2023-0001'));
-  assert.ok(diff.includes('`glibc`'));
-
-  // Unchanged count
-  assert.ok(diff.includes('| ⚪ **Unchanged Vulnerabilities** | 1 |'));
-
-  // Multi-arch is present in fixtures (amd64, arm64), so Arch column should be shown
-  assert.ok(diff.includes('| Arch |'));
-});
-
-test('renderMarkdownDiff hides Arch column when single architecture is scanned', () => {
-  const targetSingle = path.join(FIXTURES_DIR, 'target', 'cve-amd64.json');
-  const headSingle = path.join(FIXTURES_DIR, 'head', 'cve-amd64.json');
-
-  const baseCves = loadReportsForArg(targetSingle);
-  const branchCves = loadReportsForArg(headSingle);
-
-  const diff = renderMarkdownDiff(baseCves, branchCves, 'main');
-
-  assert.ok(!diff.includes('| Arch |'));
-  assert.ok(diff.includes('New Vulnerabilities Introduced (1)'));
-  assert.ok(diff.includes('Resolved / Removed Vulnerabilities (1)'));
-});
-
-test('renderFullSummary outputs summary table and lists all vulnerabilities', () => {
-  const headDir = path.join(FIXTURES_DIR, 'head');
-  const headCves = loadReportsForArg(headDir);
-
-  const summary = renderFullSummary(headCves);
-
-  assert.ok(summary.includes('### 🛡️ Security Scan Report'));
-  assert.ok(summary.includes('| Total Vulnerabilities | **2** |'));
-  assert.ok(summary.includes('CVE-2023-0002'));
-  assert.ok(summary.includes('CVE-2023-0003'));
-});
-
-test('formatVulnRow properly formats badge, architecture tag, and escape pipes', () => {
-  const vuln = {
-    Severity: 'CRITICAL',
-    VulnerabilityID: 'CVE-2023-0001',
-    PrimaryURL: 'https://avd.aquasec.com/nvd/cve-2023-0001',
-    PkgName: 'glibc',
-    InstalledVersion: '2.31',
-    FixedVersion: '2.32',
-    Title: 'A vulnerability with | pipe symbol',
-    _archs: new Set(['amd64']),
-  };
-
-  const allArchs = new Set(['amd64', 'arm64']);
-  const rowWithArch = formatVulnRow(vuln, allArchs, true);
-
-  assert.ok(rowWithArch.includes('🔴 CRITICAL'));
-  assert.ok(rowWithArch.includes('`amd64`'));
-  assert.ok(rowWithArch.includes('\\|')); // Pipe escaped
-
-  const rowWithoutArch = formatVulnRow(vuln, allArchs, false);
-  assert.ok(!rowWithoutArch.includes('`amd64`'));
-});
@@ -1,8 +0,0 @@
-{
-  "SchemaVersion": 2,
-  "ArtifactName": "debian:bullseye-slim",
-  "ArtifactType": "spdx",
-  "Metadata": {
-    "OS": null
-  }
-}
@@ -1,30 +0,0 @@
-{
-  "SchemaVersion": 2,
-  "ArtifactName": "debian:bookworm-slim",
-  "ArtifactType": "container_image",
-  "Results": [
-    {
-      "Target": "debian:bookworm-slim (debian 12)",
-      "Class": "os-pkgs",
-      "Type": "debian",
-      "Vulnerabilities": [
-        {
-          "VulnerabilityID": "CVE-2023-0002",
-          "PkgName": "openssl",
-          "InstalledVersion": "1.1.1n-0+deb11u4",
-          "FixedVersion": "1.1.1n-0+deb11u5",
-          "Severity": "HIGH",
-          "Title": "Timing attack in OpenSSL"
-        },
-        {
-          "VulnerabilityID": "CVE-2023-0003",
-          "PkgName": "curl",
-          "InstalledVersion": "7.88.1-10",
-          "FixedVersion": "7.88.1-10+deb12u1",
-          "Severity": "MEDIUM",
-          "Title": "Buffer overflow in curl"
-        }
-      ]
-    }
-  ]
-}
@@ -1,22 +0,0 @@
-{
-  "SchemaVersion": 2,
-  "ArtifactName": "debian:bookworm-slim",
-  "ArtifactType": "container_image",
-  "Results": [
-    {
-      "Target": "debian:bookworm-slim (debian 12)",
-      "Class": "os-pkgs",
-      "Type": "debian",
-      "Vulnerabilities": [
-        {
-          "VulnerabilityID": "CVE-2023-0003",
-          "PkgName": "curl",
-          "InstalledVersion": "7.88.1-10",
-          "FixedVersion": "7.88.1-10+deb12u1",
-          "Severity": "MEDIUM",
-          "Title": "Buffer overflow in curl"
-        }
-      ]
-    }
-  ]
-}
@@ -1,36 +0,0 @@
-{
-  "SchemaVersion": 2,
-  "ArtifactName": "debian:bullseye-slim",
-  "ArtifactType": "container_image",
-  "Metadata": {
-    "OS": {
-      "Family": "debian",
-      "Name": "11"
-    }
-  },
-  "Results": [
-    {
-      "Target": "debian:bullseye-slim (debian 11)",
-      "Class": "os-pkgs",
-      "Type": "debian",
-      "Vulnerabilities": [
-        {
-          "VulnerabilityID": "CVE-2023-0001",
-          "PkgName": "glibc",
-          "InstalledVersion": "2.31-13+deb11u5",
-          "FixedVersion": "2.31-13+deb11u6",
-          "Severity": "CRITICAL",
-          "Title": "Memory corruption in glibc"
-        },
-        {
-          "VulnerabilityID": "CVE-2023-0002",
-          "PkgName": "openssl",
-          "InstalledVersion": "1.1.1n-0+deb11u4",
-          "FixedVersion": "1.1.1n-0+deb11u5",
-          "Severity": "HIGH",
-          "Title": "Timing attack in OpenSSL"
-        }
-      ]
-    }
-  ]
-}
@@ -1,22 +0,0 @@
-{
-  "SchemaVersion": 2,
-  "ArtifactName": "debian:bullseye-slim",
-  "ArtifactType": "container_image",
-  "Results": [
-    {
-      "Target": "debian:bullseye-slim (debian 11)",
-      "Class": "os-pkgs",
-      "Type": "debian",
-      "Vulnerabilities": [
-        {
-          "VulnerabilityID": "CVE-2023-0001",
-          "PkgName": "glibc",
-          "InstalledVersion": "2.31-13+deb11u5",
-          "FixedVersion": "2.31-13+deb11u6",
-          "Severity": "CRITICAL",
-          "Title": "Memory corruption in glibc"
-        }
-      ]
-    }
-  ]
-}
Author	SHA1	Message	Date
Philipp	257e67ff81	feat: show Arch column only when multiple architectures are scanned Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m46s Details	2026-09-13 22:01:33 +02:00
Philipp	44dade1825	feat: support dynamic multi-architecture discovery and iteration	2026-09-13 21:51:43 +02:00