Philipp/cve-differential
Public Access
1
0 Fork 0
generated from Philipp/template-git
Code Issues 1 Pull Requests 1 Actions Packages Releases 1 Activity

feat: dynamic multi-architecture discovery, iteration, and conditional reporting #11

Merged
Philipp merged 2 commits from iterate-architectures into main 2026-09-14 00:40:44 +02:00
Conversation 0 Commits 2 Files Changed 3
+250 -100
Philipp commented 2026-09-13 22:21:00 +02:00
Owner
Copy link
Copy source

Summary of Changes

This PR introduces comprehensive multi-architecture support, dynamic platform discovery, internalized version management, and adaptive reporting to cve-differential.

1. Dynamic Architecture Discovery & Custom Selection

  • Added an optional architectures input in action.yaml:
    • Auto-Discovery (Default): When omitted or empty, inspects the OCI/Docker image index using docker buildx imagetools inspect --raw and automatically discovers all target platforms.
    • Explicit Selection: Allows callers to specify target platforms (e.g. amd64,arm64 or linux/amd64,linux/arm64).
  • Handles single-platform images seamlessly without requiring manifest lists.

2. Per-Architecture Attestation Extraction & Trivy Fallback

  • Iterates over each target architecture.
  • For each architecture, extracts the platform-specific SPDX SBOM attestation directly from the registry without downloading image layers.
  • If attestation is missing for a platform, runs trivy image --platform <platform> --format spdx-json specifically for that architecture.
  • Exports all extracted head SBOMs to the workspace root for workflow artifact uploads.

3. Internalized Version Management

  • Trivy versioning is managed and locked internally in action.yaml against checksums.txt.
  • Removed trivy-version as an external input to prevent caller environment variable mismatches (e.g. TRIVY_VERSION) from crashing the lockfile verification.
  • Renovate regex is configured to continue detecting and updating TRIVY_VERSION and checksums.txt automatically.

4. Adaptive Multi-Arch Reporting (cve-diff.js)

  • cve-diff.js now generates both the Delta Report (output-delta) and the Full Vulnerability Summary (output-summary).
  • Conditional Arch Column:
    • When more than one architecture is scanned: An Arch column is included. Findings present across all scanned architectures are badged as `all`, while architecture-specific findings list only the affected architectures (e.g. `arm64`).
    • When only one architecture is scanned (or single-arch image): The Arch column is hidden to eliminate redundant data.

📊 Report Examples

Example 1: Multi-Architecture Delta Report (cve-delta.md)

Generated when 2 or more architectures are scanned (e.g. linux/amd64, linux/arm64):

🔄 Vulnerability Delta (vs main)

Metric Count
🚨 New Vulnerabilities 🚨 2
✅ Resolved Vulnerabilities ✅ 1
⚪ Unchanged Vulnerabilities 24

🚨 New Vulnerabilities Introduced (2)

Severity CVE Package Arch Installed Fixed In Title
🔴 CRITICAL CVE-2026-1234 libssl3 all 3.0.13 3.0.14 Buffer overflow during TLS handshake
🟠 HIGH CVE-2026-5678 glibc arm64 2.36-9 2.36-10 AArch64 SIMD vector register corruption

✅ Resolved / Removed Vulnerabilities (1)

Severity CVE Package Arch Previously Installed Fixed In Title
🟡 MEDIUM CVE-2025-9876 curl amd64 7.88.1 7.88.2 HTTP/2 multiplexing resource leak

Example 2: Multi-Architecture Full Summary Report (cve-summary.md)

Consolidated inventory covering all architectures:

🛡️ Security Scan Report

Metric Count
Total Vulnerabilities 26
Severity CVE Package Arch Installed Fixed In Title
🔴 CRITICAL CVE-2026-1234 libssl3 all 3.0.13 3.0.14 Buffer overflow during TLS handshake
🟠 HIGH CVE-2026-5678 glibc arm64 2.36-9 2.36-10 AArch64 SIMD vector register corruption
🟡 MEDIUM CVE-2026-3344 zlib1g all 1:1.2.13 1:1.2.14 Compression length mismatch

Example 3: Single-Architecture Scan Report

Generated when a single architecture is scanned (e.g. single-platform image or architectures: 'amd64'). Note the Arch column is automatically omitted:

🔄 Vulnerability Delta (vs main)

Metric Count
🚨 New Vulnerabilities 🚨 1
✅ Resolved Vulnerabilities 0
⚪ Unchanged Vulnerabilities 12

🚨 New Vulnerabilities Introduced (1)

Severity CVE Package Installed Fixed In Title
🔴 CRITICAL CVE-2026-1234 libssl3 3.0.13 3.0.14 Buffer overflow during TLS handshake
## Summary of Changes This PR introduces comprehensive multi-architecture support, dynamic platform discovery, internalized version management, and adaptive reporting to `cve-differential`. ### 1. Dynamic Architecture Discovery & Custom Selection - Added an optional `architectures` input in `action.yaml`: - **Auto-Discovery (Default)**: When omitted or empty, inspects the OCI/Docker image index using `docker buildx imagetools inspect --raw` and automatically discovers all target platforms. - **Explicit Selection**: Allows callers to specify target platforms (e.g. `amd64,arm64` or `linux/amd64,linux/arm64`). - Handles single-platform images seamlessly without requiring manifest lists. ### 2. Per-Architecture Attestation Extraction & Trivy Fallback - Iterates over each target architecture. - For each architecture, extracts the platform-specific SPDX SBOM attestation directly from the registry without downloading image layers. - If attestation is missing for a platform, runs `trivy image --platform <platform> --format spdx-json` specifically for that architecture. - Exports all extracted head SBOMs to the workspace root for workflow artifact uploads. ### 3. Internalized Version Management - Trivy versioning is managed and locked internally in `action.yaml` against `checksums.txt`. - Removed `trivy-version` as an external input to prevent caller environment variable mismatches (e.g. `TRIVY_VERSION`) from crashing the lockfile verification. - Renovate regex is configured to continue detecting and updating `TRIVY_VERSION` and `checksums.txt` automatically. ### 4. Adaptive Multi-Arch Reporting (`cve-diff.js`) - `cve-diff.js` now generates both the **Delta Report** (`output-delta`) and the **Full Vulnerability Summary** (`output-summary`). - **Conditional `Arch` Column**: - When **more than one architecture** is scanned: An `Arch` column is included. Findings present across all scanned architectures are badged as `` `all` ``, while architecture-specific findings list only the affected architectures (e.g. `` `arm64` ``). - When **only one architecture** is scanned (or single-arch image): The `Arch` column is hidden to eliminate redundant data. --- ## 📊 Report Examples ### Example 1: Multi-Architecture Delta Report (`cve-delta.md`) *Generated when 2 or more architectures are scanned (e.g. `linux/amd64`, `linux/arm64`):* ### 🔄 Vulnerability Delta (vs `main`) | Metric | Count | | :--- | :--- | | 🚨 **New Vulnerabilities** | 🚨 **2** | | ✅ **Resolved Vulnerabilities** | ✅ **1** | | ⚪ **Unchanged Vulnerabilities** | 24 | #### 🚨 New Vulnerabilities Introduced (2) | Severity | CVE | Package | Arch | Installed | Fixed In | Title | | :--- | :--- | :--- | :--- | :--- | :--- | :--- | | 🔴 CRITICAL | [CVE-2026-1234](https://nvd.nist.gov/vuln/detail/CVE-2026-1234) | `libssl3` | `all` | 3.0.13 | 3.0.14 | Buffer overflow during TLS handshake | | 🟠 HIGH | [CVE-2026-5678](https://nvd.nist.gov/vuln/detail/CVE-2026-5678) | `glibc` | `arm64` | 2.36-9 | 2.36-10 | AArch64 SIMD vector register corruption | #### ✅ Resolved / Removed Vulnerabilities (1) | Severity | CVE | Package | Arch | Previously Installed | Fixed In | Title | | :--- | :--- | :--- | :--- | :--- | :--- | :--- | | 🟡 MEDIUM | [CVE-2025-9876](https://nvd.nist.gov/vuln/detail/CVE-2025-9876) | `curl` | `amd64` | 7.88.1 | 7.88.2 | HTTP/2 multiplexing resource leak | --- ### Example 2: Multi-Architecture Full Summary Report (`cve-summary.md`) *Consolidated inventory covering all architectures:* ### 🛡️ Security Scan Report | Metric | Count | | :--- | :--- | | Total Vulnerabilities | **26** | | Severity | CVE | Package | Arch | Installed | Fixed In | Title | | :--- | :--- | :--- | :--- | :--- | :--- | :--- | | 🔴 CRITICAL | [CVE-2026-1234](https://nvd.nist.gov/vuln/detail/CVE-2026-1234) | `libssl3` | `all` | 3.0.13 | 3.0.14 | Buffer overflow during TLS handshake | | 🟠 HIGH | [CVE-2026-5678](https://nvd.nist.gov/vuln/detail/CVE-2026-5678) | `glibc` | `arm64` | 2.36-9 | 2.36-10 | AArch64 SIMD vector register corruption | | 🟡 MEDIUM | [CVE-2026-3344](https://nvd.nist.gov/vuln/detail/CVE-2026-3344) | `zlib1g` | `all` | 1:1.2.13 | 1:1.2.14 | Compression length mismatch | --- ### Example 3: Single-Architecture Scan Report *Generated when a single architecture is scanned (e.g. single-platform image or `architectures: 'amd64'`). Note the `Arch` column is automatically omitted:* ### 🔄 Vulnerability Delta (vs `main`) | Metric | Count | | :--- | :--- | | 🚨 **New Vulnerabilities** | 🚨 **1** | | ✅ **Resolved Vulnerabilities** | 0 | | ⚪ **Unchanged Vulnerabilities** | 12 | #### 🚨 New Vulnerabilities Introduced (1) | Severity | CVE | Package | Installed | Fixed In | Title | | :--- | :--- | :--- | :--- | :--- | :--- | | 🔴 CRITICAL | [CVE-2026-1234](https://nvd.nist.gov/vuln/detail/CVE-2026-1234) | `libssl3` | 3.0.13 | 3.0.14 | Buffer overflow during TLS handshake |
Philipp added 2 commits 2026-09-13 22:47:07 +02:00
feat: support dynamic multi-architecture discovery and iteration e232a22547
feat: show Arch column only when multiple architectures are scanned
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 3m5s
Details
e394966a96
Philipp force-pushed iterate-architectures from 257e67ff81 to e394966a96 2026-09-13 22:47:07 +02:00 Compare
Philipp merged commit 015e40634a into main 2026-09-14 00:40:44 +02:00
Philipp deleted branch iterate-architectures 2026-09-14 00:40:44 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
AutoReview (LLMReview) Renovate (Renovate Bot) runner (Act Runner) Philipp (Philipp Horstenkamp)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Philipp/cve-differential#11