Skip to content

ci(security): give the image scans their own code-scanning tool (#2266) #2396

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cyberantonz merged 3 commits into from
Aug 11, 2026
Merged

ci(security): give the image scans their own code-scanning tool (#2266) #2396

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
320935d
ci(security): give the image scans their own code-scanning tool (#2266)
Gregory91G Aug 10, 2026
47641c3
ci(security): rename the SARIF tool with jq instead of python
Gregory91G Aug 10, 2026
abe9518
Merge branch 'main' into ci/drop-image-sarif-upload
Gregory91G Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/workflows/trivy-images.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,15 @@ jobs:
out.close()
PY

- name: Give the image scans their own tool name
# Code scanning reports missing configurations per tool, and only this nightly
# can produce these categories — keep them off the Trivy check PRs see (#2266).
if: ${{ always() && hashFiles('trivy-image.sarif') != '' }}
run: |
set -euo pipefail
jq '.runs[].tool.driver.name = "Trivy Images"' trivy-image.sarif > renamed.sarif
mv renamed.sarif trivy-image.sarif
Comment on lines +141 to +145

@coderabbitai coderabbitai Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
fd -a 'trivy-images.yml|trivy' .github 2>/dev/null || true

echo "== target section =="
if [ -f .github/workflows/trivy-images.yml ]; then
  nl -ba .github/workflows/trivy-images.yml | sed -n '120,165p'
fi

echo "== normalization/upload references =="
rg -n "normalize_sarif|trivy-image\.sarif|rename|rm|jq|Upload SARIF|actionlint" .github/workflows/trivy-images.yml || true

echo "== nearby workflow structure =="
rg -n "jobs:|trivy-image-scan|upload|sarif" .github/workflows/trivy-images.yml || true

Repository: constructorfabric/insight

Length of output: 346

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/trivy-images.yml')
if not p.exists():
    raise SystemExit(0)
text = p.read_text()
lines = text.splitlines()

start = next((i for i,l in enumerate(lines,1) if 'Give the image scans their own tool name' in l), None)
upload_start = next((i for i,l in enumerate(lines,1) if 'Upload SARIF to GitHub Code Scanning' in l), None)

for section in [(start, 'normalize section'), (upload_start, 'upload section')]:
    idx, name = section
    if idx is None:
        print(f'{name}: not found')
        continue
    # print until next indent 8 at same or lower level? rough
    end = next((i for i,l in enumerate(lines[idx:], idx+1) if l.startswith('      - name: ') or l.startswith('    - name: ') or i==len(lines)), min(len(lines)+1, idx+25))
    print(f"\n== {name} lines {idx}-{end-1} ==")
    for n,line in enumerate(lines[idx:min(end, len(lines)+1)], idx):
        print(f'{n}:{line}')
PY

Repository: constructorfabric/insight

Length of output: 1262

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/trivy-images.yml')
text = p.read_text()
lines = text.splitlines()

print("== normalization step context ==")
for i in range(128, 147):
    print(f"{i+1}: {lines[i]}")

print("\n== upload step context ==")
for i in range(146, 155):
    print(f"{i+1}: {lines[i]}")

print("\n== normalize_sarif id and success guard references ==")
for i,l in enumerate(lines):
    if 'normalize_sarif' in l or "steps." in l:
        print(f"{i+1}: {l}")

PY

Repository: constructorfabric/insight

Length of output: 1978

Gate the upload on successful SARIF normalization.

The normalize step does not set an id, and the upload step still uses hash-only existence checks. If jq or mv fails, the original trivy-image.sarif may remain and still be uploaded. Add id: normalize_sarif to the normalize step and require steps.normalize_sarif.outcome == 'success' in the upload condition.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/trivy-images.yml around lines 141 - 145, Add id
normalize_sarif to the SARIF normalization step containing jq and mv, then
update the upload step’s if condition to require steps.normalize_sarif.outcome
== 'success' in addition to the existing checks.


- name: Upload SARIF to GitHub Code Scanning
# Guard: a failed pull must not also report a missing SARIF.
if: ${{ always() && hashFiles('trivy-image.sarif') != '' }}
Expand Down