feat: Run trivy container scan

cli-v2.go

@@ -39,10 +39,10 @@ func main() {
 		}
 	}
 
-	// Check if command is init/update/version/help - these don't require configuration
+	// Check if command is init/update/version/help/container-scan - these don't require configuration
 	if len(os.Args) > 1 {
 		cmdName := os.Args[1]
-		if cmdName == "init" || cmdName == "update" || cmdName == "version" || cmdName == "help" {
+		if cmdName == "init" || cmdName == "update" || cmdName == "version" || cmdName == "help" || cmdName == "container-scan" {
 			cmd.Execute()
 			return
 		}

cmd/container_scan.go

@@ -0,0 +1,276 @@
+// Package cmd implements the CLI commands for the Codacy CLI tool.
+package cmd
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"regexp"
+	"strings"
+
+	"codacy/cli-v2/utils/logger"
+
+	"github.com/fatih/color"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+)
+
+// validImageNamePattern validates Docker image references
+// Allows: registry/namespace/image:tag or image@sha256:digest
+// Based on Docker image reference specification
+var validImageNamePattern = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._\-/:@]*$`)
+
+// lookPath is a variable to allow mocking exec.LookPath in tests
+var lookPath = exec.LookPath
+
+// exitFunc is a variable to allow mocking os.Exit in tests
+var exitFunc = os.Exit
+
+// CommandRunner interface for running external commands (allows mocking in tests)
+type CommandRunner interface {
+	Run(name string, args []string) error
+}
+
+// ExecCommandRunner runs commands using exec.Command
+type ExecCommandRunner struct{}
+
+// Run executes a command and returns its exit error
+func (r *ExecCommandRunner) Run(name string, args []string) error {
+	// #nosec G204 -- name comes from exec.LookPath("trivy") with a literal string,
+	// and args are validated by validateImageName() which checks for shell metacharacters.
+	// exec.Command passes arguments directly without shell interpretation.
+	cmd := exec.Command(name, args...)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+
+// commandRunner is the default command runner, can be replaced in tests
+var commandRunner CommandRunner = &ExecCommandRunner{}
+
+// ExitCoder interface for errors that have an exit code
+type ExitCoder interface {
+	ExitCode() int
+}
+
+// getExitCode returns the exit code from an error if it implements ExitCoder
+func getExitCode(err error) int {
+	if exitErr, ok := err.(ExitCoder); ok {
+		return exitErr.ExitCode()
+	}
+	return -1
+}
+
+// Flag variables for container-scan command
+var (
+	severityFlag      string
+	pkgTypesFlag      string
+	ignoreUnfixedFlag bool
+)
+
+func init() {
+	containerScanCmd.Flags().StringVar(&severityFlag, "severity", "", "Comma-separated list of severities to scan for (default: HIGH,CRITICAL)")
+	containerScanCmd.Flags().StringVar(&pkgTypesFlag, "pkg-types", "", "Comma-separated list of package types to scan (default: os)")
+	containerScanCmd.Flags().BoolVar(&ignoreUnfixedFlag, "ignore-unfixed", true, "Ignore unfixed vulnerabilities")
+	rootCmd.AddCommand(containerScanCmd)
+}
+
+var containerScanCmd = &cobra.Command{
+	Use:   "container-scan <IMAGE_NAME> [IMAGE_NAME...]",
+	Short: "Scan container images for vulnerabilities using Trivy",
+	Long: `Scan one or more container images for vulnerabilities using Trivy.
+
+By default, scans for HIGH and CRITICAL vulnerabilities in OS packages,
+ignoring unfixed issues. Use flags to override these defaults.
+
+The --exit-code 1 flag is always applied (not user-configurable) to ensure
+the command fails when vulnerabilities are found in any image.`,
+	Example: `  # Scan a single image
+  codacy-cli container-scan myapp:latest
+
+  # Scan multiple images
+  codacy-cli container-scan myapp:latest nginx:alpine redis:7
+
+  # Scan only for CRITICAL vulnerabilities across multiple images
+  codacy-cli container-scan --severity CRITICAL myapp:latest nginx:alpine
+
+  # Scan all severities and package types
+  codacy-cli container-scan --severity LOW,MEDIUM,HIGH,CRITICAL --pkg-types os,library myapp:latest
+
+  # Include unfixed vulnerabilities
+  codacy-cli container-scan --ignore-unfixed=false myapp:latest`,
+	Args: cobra.MinimumNArgs(1),
+	Run:  runContainerScan,
+}
+
+// validateImageName checks if the image name is a valid Docker image reference
+// and doesn't contain shell metacharacters that could be used for command injection
+func validateImageName(imageName string) error {
+	if imageName == "" {
+		return fmt.Errorf("image name cannot be empty")
+	}
+
+	// Check for maximum length (Docker has a practical limit)
+	if len(imageName) > 256 {
+		return fmt.Errorf("image name is too long (max 256 characters)")
+	}
+
+	// Check for dangerous shell metacharacters first for specific error messages
+	dangerousChars := []string{";", "&", "|", "$", "`", "(", ")", "{", "}", "<", ">", "!", "\\", "\n", "\r", "'", "\""}
+	for _, char := range dangerousChars {
+		if strings.Contains(imageName, char) {
+			return fmt.Errorf("invalid image name: contains disallowed character '%s'", char)
+		}
+	}
+
+	// Validate against allowed pattern for any other invalid characters
+	if !validImageNamePattern.MatchString(imageName) {
+		return fmt.Errorf("invalid image name format: contains disallowed characters")
+	}
+
+	return nil
+}
+
+// getTrivyPath returns the path to the Trivy binary and an error if not found
+func getTrivyPath() (string, error) {
+	trivyPath, err := lookPath("trivy")
+	if err != nil {
+		return "", err
+	}
+	logger.Info("Found Trivy", logrus.Fields{"path": trivyPath})
+	return trivyPath, nil
+}
+
+// handleTrivyNotFound prints error message and exits with code 2
+func handleTrivyNotFound(err error) {
+	logger.Error("Trivy not found", logrus.Fields{"error": err.Error()})
+	color.Red("❌ Error: Trivy is not installed or not found in PATH")
+	fmt.Println("Please install Trivy to use container scanning.")
+	fmt.Println("Visit: https://trivy.dev/latest/getting-started/installation/")
+	fmt.Println("exit-code 2")
+	exitFunc(2)
+}
+
+func runContainerScan(_ *cobra.Command, args []string) {
+	exitCode := executeContainerScan(args)
+	exitFunc(exitCode)
+}
+
+// executeContainerScan performs the container scan and returns an exit code
+// Exit codes: 0 = success, 1 = vulnerabilities found, 2 = error
+func executeContainerScan(imageNames []string) int {
+	if code := validateAllImages(imageNames); code != 0 {
+		return code
+	}
+	logger.Info("Starting container scan", logrus.Fields{"images": imageNames, "count": len(imageNames)})
+
+	trivyPath, err := getTrivyPath()
+	if err != nil {
+		handleTrivyNotFound(err)
+		return 2
+	}
+
+	hasVulnerabilities := scanAllImages(imageNames, trivyPath)
+	if hasVulnerabilities == -1 {
+		return 2
+	}
+	return printScanSummary(hasVulnerabilities == 1, imageNames)
+}
+
+func validateAllImages(imageNames []string) int {
+	for _, imageName := range imageNames {
+		if err := validateImageName(imageName); err != nil {
+			logger.Error("Invalid image name", logrus.Fields{"image": imageName, "error": err.Error()})
+			color.Red("❌ Error: %v", err)
+			fmt.Println("exit-code 2")
+			return 2
+		}
+	}
+	return 0
+}
+
+// scanAllImages scans all images and returns: 0=no vulns, 1=vulns found, -1=error
+func scanAllImages(imageNames []string, trivyPath string) int {
+	hasVulnerabilities := false
+	for i, imageName := range imageNames {
+		printScanHeader(imageNames, imageName, i)
+		args := buildTrivyArgs(imageName)
+		logger.Info("Running Trivy container scan", logrus.Fields{"command": fmt.Sprintf("%s %v", trivyPath, args)})
+
+		if err := commandRunner.Run(trivyPath, args); err != nil {
+			if getExitCode(err) == 1 {
+				logger.Warn("Vulnerabilities found in image", logrus.Fields{"image": imageName})
+				hasVulnerabilities = true
+			} else {
+				logger.Error("Failed to run Trivy", logrus.Fields{"error": err.Error(), "image": imageName})
+				color.Red("❌ Error: Failed to run Trivy for %s: %v", imageName, err)
+				fmt.Println("exit-code 2")
+				return -1
+			}
+		} else {
+			logger.Info("No vulnerabilities found in image", logrus.Fields{"image": imageName})
+		}
+	}
+	if hasVulnerabilities {
+		return 1
+	}
+	return 0
+}
+
+func printScanHeader(imageNames []string, imageName string, index int) {
+	if len(imageNames) > 1 {
+		fmt.Printf("\n📦 [%d/%d] Scanning image: %s\n", index+1, len(imageNames), imageName)
+		fmt.Println(strings.Repeat("-", 50))
+	} else {
+		fmt.Printf("🔍 Scanning container image: %s\n\n", imageName)
+	}
+}
+
+func printScanSummary(hasVulnerabilities bool, imageNames []string) int {
+	fmt.Println()
+	if hasVulnerabilities {
+		logger.Warn("Container scan completed with vulnerabilities", logrus.Fields{"images": imageNames})
+		color.Red("❌ Scanning failed: vulnerabilities found in one or more container images")
+		fmt.Println("exit-code 1")
+		return 1
+	}
+	logger.Info("Container scan completed successfully", logrus.Fields{"images": imageNames})
+	color.Green("✅ Success: No vulnerabilities found matching the specified criteria")
+	fmt.Println("exit-code 0")
+	return 0
+}
+
+// buildTrivyArgs constructs the Trivy command arguments based on flags
+func buildTrivyArgs(imageName string) []string {
+	args := []string{
+		"image",
+		"--scanners", "vuln",
+	}
+
+	// Apply --ignore-unfixed if enabled (default: true)
+	if ignoreUnfixedFlag {
+		args = append(args, "--ignore-unfixed")
+	}
+
+	// Apply --severity (use default if not specified)
+	severity := severityFlag
+	if severity == "" {
+		severity = "HIGH,CRITICAL"
+	}
+	args = append(args, "--severity", severity)
+
+	// Apply --pkg-types (use default if not specified)
+	pkgTypes := pkgTypesFlag
+	if pkgTypes == "" {
+		pkgTypes = "os"
+	}
+	args = append(args, "--pkg-types", pkgTypes)
+
+	// Always apply --exit-code 1 (not user-configurable)
+	args = append(args, "--exit-code", "1")
+
+	// Add the image name as the last argument
+	args = append(args, imageName)
+
+	return args
+}