V3 mi by mukulmj · Pull Request #16 · OT-BUILDPIPER-MARKETPLACE/BP-TRIVY-STEP

mukulmj · 2025-03-31T10:56:19Z

Version	Added	Improved	Bug Resolved	Date
0.5.11-mi	Python dependency added to execute a script for viewing data in CSV format.	Pushes data for both `high` and `critical` severities. Default values for `SCANNER`, `SCAN_SEVERITY`, `FORMAT_ARG`, and `OUTPUT_ARG` are set in the Dockerfile.	`SOURCE_KEY` is no longer required, simplifying configuration.	March 31, 2025

#15

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

shellcheck

📝 [shellcheck] _{reported by reviewdog 🐶}
Expressions don't expand in single quotes, use double quotes for that. SC2016

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 52 in 1086936

    
           trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}

📝 [shellcheck] _{reported by reviewdog 🐶}
Double quote to prevent globbing and word splitting. SC2086

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 52 in 1086936

    
           trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}

📝 [shellcheck] _{reported by reviewdog 🐶}
Double quote to prevent globbing and word splitting. SC2086

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 52 in 1086936

    
           trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}

📝 [shellcheck] _{reported by reviewdog 🐶}
Double quote to prevent globbing and word splitting. SC2086

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 52 in 1086936

    
           trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}

⚠️ [shellcheck] _{reported by reviewdog 🐶}
Declare and assign separately to avoid masking return values. SC2155

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 74 in 1086936

export base64EncodedResponse=`encodeFileContent reports/trivy_mi.csv`

[shellcheck] _{reported by reviewdog 🐶}
Use $(...) notation instead of legacy backticks .... SC2006

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 74 in 1086936

export base64EncodedResponse=`encodeFileContent reports/trivy_mi.csv`

📝 [shellcheck] _{reported by reviewdog 🐶}
Double quote to prevent globbing and word splitting. SC2086

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 90 in 1086936

if ! sendMIData trivy.mi ${MI_SERVER_ADDRESS}; then

📝 [shellcheck] _{reported by reviewdog 🐶}
Double quote to prevent globbing and word splitting. SC2086

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 107 in 1086936

    
           generateOutput ${ACTIVITY_SUB_TASK_CODE} true "Congratulations! Trivy scan succeeded!"

📝 [shellcheck] _{reported by reviewdog 🐶}
Double quote to prevent globbing and word splitting. SC2086

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 110 in 1086936

generateOutput ${ACTIVITY_SUB_TASK_CODE} false "Trivy scan failed!"

📝 [shellcheck] _{reported by reviewdog 🐶}
Double quote to prevent globbing and word splitting. SC2086

BP-TRIVY-STEP/imageTrivyScanner.sh

Line 114 in 1086936

generateOutput ${ACTIVITY_SUB_TASK_CODE} true "Trivy scan failed!"

📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

BP-TRIVY-STEP/build.sh

Line 3 in 1086936

source /opt/buildpiper/shell-functions/functions.sh

📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/mi-functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

BP-TRIVY-STEP/build.sh

Line 4 in 1086936

source /opt/buildpiper/shell-functions/mi-functions.sh

📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/log-functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

BP-TRIVY-STEP/build.sh

Line 5 in 1086936

source /opt/buildpiper/shell-functions/log-functions.sh

📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/str-functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

BP-TRIVY-STEP/build.sh

Line 6 in 1086936

source /opt/buildpiper/shell-functions/str-functions.sh

📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/file-functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

BP-TRIVY-STEP/build.sh

Line 7 in 1086936

source /opt/buildpiper/shell-functions/file-functions.sh

📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/aws-functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

BP-TRIVY-STEP/build.sh

Line 8 in 1086936

source /opt/buildpiper/shell-functions/aws-functions.sh

📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/getDataFile.sh: openBinaryFile: does not exist (No such file or directory) SC1091

BP-TRIVY-STEP/build.sh

Line 9 in 1086936

source /opt/buildpiper/shell-functions/getDataFile.sh

github-actions · 2025-03-31T10:56:33Z

@@ -0,0 +1,10 @@
+awk 'BEGIN { FS="[:,]"; OFS="," }


🚫 [shellcheck] _{reported by reviewdog 🐶}
Tips depend on target shell and yours is unknown. Add a shebang or a 'shell' directive. SC2148

github-actions · 2025-03-31T10:56:33Z

 #!/bin/bash
-source functions.sh
+
+source /opt/buildpiper/shell-functions/functions.sh


📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

github-actions · 2025-03-31T10:56:33Z

-source functions.sh
+
+source /opt/buildpiper/shell-functions/functions.sh
+source /opt/buildpiper/shell-functions/mi-functions.sh


📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/mi-functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

github-actions · 2025-03-31T10:56:33Z

+
+source /opt/buildpiper/shell-functions/functions.sh
+source /opt/buildpiper/shell-functions/mi-functions.sh
+source /opt/buildpiper/shell-functions/log-functions.sh


📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/log-functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

github-actions · 2025-03-31T10:56:33Z

+source /opt/buildpiper/shell-functions/functions.sh
+source /opt/buildpiper/shell-functions/mi-functions.sh
+source /opt/buildpiper/shell-functions/log-functions.sh
+source /opt/buildpiper/shell-functions/str-functions.sh


📝 [shellcheck] _{reported by reviewdog 🐶}
Not following: /opt/buildpiper/shell-functions/str-functions.sh: openBinaryFile: does not exist (No such file or directory) SC1091

github-actions · 2025-03-31T10:56:35Z

+    mkdir -p reports
+    trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 ${FORMAT_ARG} ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}
+
+    logInfoMessage "Executing trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}"


⚠️ [shellcheck] _{reported by reviewdog 🐶}
critical is referenced but not assigned. SC2154

github-actions · 2025-03-31T10:56:35Z

+    mkdir -p reports
+    trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 ${FORMAT_ARG} ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}
+
+    logInfoMessage "Executing trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}"


⚠️ [shellcheck] _{reported by reviewdog 🐶}
high is referenced but not assigned. SC2154

github-actions · 2025-03-31T10:56:35Z

+    mkdir -p reports
+    trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 ${FORMAT_ARG} ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}
+
+    logInfoMessage "Executing trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}"


⚠️ [shellcheck] _{reported by reviewdog 🐶}
Word is of the form "A"B"C" (B indicated). Did you mean "ABC" or "A"B"C"? SC2140

github-actions · 2025-03-31T10:56:35Z

+    mkdir -p reports
+    trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 ${FORMAT_ARG} ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}
+
+    logInfoMessage "Executing trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}"


⚠️ [shellcheck] _{reported by reviewdog 🐶}
Word is of the form "A"B"C" (B indicated). Did you mean "ABC" or "A"B"C"? SC2140

github-actions · 2025-03-31T10:56:35Z

+
+    logInfoMessage "Executing trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}"
+
+    trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}


📝 [shellcheck] _{reported by reviewdog 🐶}
Double quote to prevent globbing and word splitting. SC2086

github-actions · 2025-03-31T10:56:38Z

📝 [shellcheck] _{reported by reviewdog 🐶}
Double quote to prevent globbing and word splitting. SC2086

BP-TRIVY-STEP/build.sh

Line 24 in 1086936

generateOutput ${ACTIVITY_SUB_TASK_CODE} true "Please check incompatible scanner passed!!!"

rishops and others added 8 commits February 1, 2024 16:44

feat: add MI support

467559e

chore: do not encode if output file is JSON

9e007f6

chore: add template to CSV converter

14a2126

updated file with source details

e7ece2c

updated vars

fb96bd1

updated with image tag 0.5.11-mi

a49cfef

updted readme

5f5056f

updated BP-BASE-SHELL-STEPS

1086936

mukulmj added bug Something isn't working documentation Improvements or additions to documentation enhancement New feature or request labels Mar 31, 2025

mukulmj requested a review from deepakgupta97 March 31, 2025 10:56

mukulmj self-assigned this Mar 31, 2025

github-actions Bot reviewed Mar 31, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

V3 mi#16

V3 mi#16
mukulmj wants to merge 8 commits into
mainfrom
v3-mi

mukulmj commented Mar 31, 2025

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

github-actions Bot Mar 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		logInfoMessage "Executing trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}"

		trivy image -q --severity ${SCAN_SEVERITY} --exit-code 1 --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' ${OUTPUT_ARG} ${IMAGE_NAME}:${IMAGE_TAG}

Conversation

mukulmj commented Mar 31, 2025

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Mar 31, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants