README.md

@@ -27,6 +27,7 @@ A self-contained Gitea and GitHub Actions composite action that extracts multi-p
 | `trivy-version` | Trivy version to install and verify | No | `0.74.0` |
 | `output-delta` | Output path for the CVE delta Markdown report | No | `cve-delta.md` |
 | `output-summary` | Output path for the full vulnerability Markdown summary | No | `cve-summary.md` |
+| `write-summary` | Whether to append the generated reports to the job summary (`$GITHUB_STEP_SUMMARY`) | No | `true` |
 
 ---
 
@@ -56,18 +57,11 @@ jobs:
           tags: registry.example.com/my-app:git-${{ github.sha }}
 
       - name: Compare Vulnerabilities (Head vs Target)
-        uses: Philipp/cve-differential@main
+        uses: https://git.horstenkamp.eu/Philipp/cve-differential@main
         with:
           head-image: registry.example.com/my-app:git-${{ github.sha }}
           target-image: registry.example.com/my-app:latest
           target-branch: ${{ github.base_ref || 'main' }}
-
-      - name: Publish CVE Delta to Job Summary
-        if: always()
-        run: |
-          if [ -f cve-delta.md ]; then
-            cat cve-delta.md >> "$GITHUB_STEP_SUMMARY"
-          fi
 ```
 
 ---

action.yaml

@@ -24,6 +24,10 @@ inputs:
     description: Output markdown file for full vulnerability summary
     required: false
     default: cve-summary.md
+  write-summary:
+    description: Whether to append the generated reports to the job summary ($GITHUB_STEP_SUMMARY)
+    required: false
+    default: 'true'
 
 outputs:
   delta-report:
@@ -184,3 +188,15 @@ runs:
           --output "${{ inputs.output-summary }}" \
           "$primary_sbom" || true
       fi
+
+  - name: Publish Reports to Step Summary
+    shell: bash
+    run: |
+      if [ "${{ inputs.write-summary }}" = "true" ] && [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+        if [ -f "${{ inputs.output-delta }}" ]; then
+          cat "${{ inputs.output-delta }}" >> "$GITHUB_STEP_SUMMARY"
+        fi
+        if [ -f "${{ inputs.output-summary }}" ]; then
+          cat "${{ inputs.output-summary }}" >> "$GITHUB_STEP_SUMMARY"
+        fi
+      fi

markdown.tpl

@@ -14,10 +14,7 @@
   {{- end }}
 {{- end }}
 
-{{- $hasFindings := false }}
-
 {{- if .Vulnerabilities }}
-{{- $hasFindings = true }}
 #### Target: `{{ $targetName }}` (Vulnerabilities)
 
 | Severity | CVE | Package | Installed | Fixed In | Title |
@@ -30,38 +27,9 @@
 {{- end }}
 {{- end }}
 {{- end }}
-{{- end }}
-
-{{- if .Misconfigurations }}
-{{- $hasFindings = true }}
-#### Target: `{{ $targetName }}` (Misconfigurations)
-
-| Severity | Rule ID | Title | Message | Resolution |
-| :--- | :--- | :--- | :--- | :--- |
-{{- $misconfs := .Misconfigurations }}
-{{- range $sev := list "CRITICAL" "HIGH" "MEDIUM" "LOW" "UNKNOWN" }}
-{{- range $m := $misconfs }}
-{{- if eq $m.Severity $sev }}
-| {{ if eq $m.Severity "CRITICAL" }}🔴 CRITICAL{{ else if eq $m.Severity "HIGH" }}🟠 HIGH{{ else if eq $m.Severity "MEDIUM" }}🟡 MEDIUM{{ else if eq $m.Severity "LOW" }}🔵 LOW{{ else }}⚪ {{ $m.Severity }}{{ end }} | [{{ $m.ID }}]({{ $m.PrimaryURL }}) | {{ $m.Title }} | {{ $m.Message }} | {{ default "-" $m.Resolution }} |
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{- if .Secrets }}
-{{- $hasFindings = true }}
-#### Target: `{{ $targetName }}` (Secrets)
-
-| Severity | Rule ID | Title | Lines |
-| :--- | :--- | :--- | :--- |
-{{- range .Secrets }}
-| {{ if eq .Severity "CRITICAL" }}🔴 CRITICAL{{ else if eq .Severity "HIGH" }}🟠 HIGH{{ else if eq .Severity "MEDIUM" }}🟡 MEDIUM{{ else if eq .Severity "LOW" }}🔵 LOW{{ else }}⚪ {{ .Severity }}{{ end }} | {{ .RuleID }} | {{ .Title }} | L{{ .StartLine }}-L{{ .EndLine }} |
-{{- end }}
-{{- end }}
-
-{{- if not $hasFindings }}
+{{- else }}
 #### Target: `{{ $targetName }}`
-✅ No security issues found.
+✅ No vulnerabilities found.
 {{- end }}
 
 {{- end }}