fix: Refer to scan-ref when scan-type is "sbom" (#314)

* Improved documentation with details on how to send output as an artifact on Github and giving an example of a private image scan

* formatting

* better name for job

.github/workflows/build.yaml

@@ -1,7 +1,7 @@
 name: "build"
 on: [push, pull_request]
 env:
-  TRIVY_VERSION: 0.48.0
+  TRIVY_VERSION: 0.49.0
   BATS_LIB_PATH: '/usr/lib/'
 jobs:
   build:

Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/aquasecurity/trivy:0.48.0
+FROM ghcr.io/aquasecurity/trivy:0.49.0
 COPY entrypoint.sh /
 RUN apk --no-cache add bash curl npm
 RUN chmod +x /entrypoint.sh

README.md

@@ -79,6 +79,8 @@ In this case `trivy.yaml` is a YAML configuration that is checked in as part of
 format: json
 exit-code: 1
 severity: CRITICAL
+secret:
+  config: config/trivy/secret.yaml
 ```
 
 It is possible to define all options in the `trivy.yaml` file. Specifying individual options via the action are left for backward compatibility purposes. Defining the following is required as they cannot be defined with the config file:
@@ -86,7 +88,7 @@ It is possible to define all options in the `trivy.yaml` file. Specifying indivi
 - `image-ref`: If using `image` scan.
 - `scan-type`: To define the scan type, e.g. `image`, `fs`, `repo`, etc.
 
-#### Order of prerference for options
+#### Order of preference for options
 Trivy uses [Viper](https://github.com/spf13/viper) which has a defined precedence order for options. The order is as follows:
 - GitHub Action flag
 - Environment variable
@@ -335,6 +337,49 @@ jobs:
           github-pat: ${{ secrets.GITHUB_TOKEN }} # or ${{ secrets.github_pat_name }} if you're using a PAT
 ```
 
+When scanning images you may want to parse the actual output JSON as Github Dependency doesn't show all details like the file path of each dependency for instance.
+
+You can upload the report as an artifact and download it, for instance using the [upload-artifact action](https://github.com/actions/upload-artifact):
+
+```yaml
+---
+name: Pull Request
+on:
+  push:
+    branches:
+    - main
+
+## GITHUB_TOKEN authentication, add only if you're not going to use a PAT
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: Checks
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Scan image in a private registry
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "private_image_registry/image_name:image_tag"
+          scan-type: image
+          format: 'github'
+          output: 'dependency-results.sbom.json'
+          github-pat: ${{ secrets.GITHUB_TOKEN }} # or ${{ secrets.github_pat_name }} if you're using a PAT
+          severity: "MEDIUM,HIGH,CRITICAL"
+          scanners: "vuln"
+        env:
+          TRIVY_USERNAME: "image_registry_admin_username"
+          TRIVY_PASSWORD: "image_registry_admin_password"
+
+      - name: Upload trivy report as a Github artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-sbom-report
+          path: '${{ github.workspace }}/dependency-results.sbom.json'
+          retention-days: 20 # 90 is the default
+```
+
 ### Using Trivy to scan your private registry
 It's also possible to scan your private registry with Trivy's built-in image scan. All you have to do is set ENV vars.
 
@@ -479,36 +524,49 @@ jobs:
 
 ## Customizing
 
+Configuration priority:
+- [Inputs](#inputs)
+- [Environment variables](#environment-variables)
+- [Trivy config file](#trivy-config-file)
+- Default values
+
+
 ### inputs
 
 Following inputs can be used as `step.with` keys:
 
-| Name              | Type    | Default                            | Description                                                                                     |
+| Name                         | Type    | Default                            | Description                                                                                                                                                    |
-|-------------------|---------|------------------------------------|-------------------------------------------------------------------------------------------------|
+|------------------------------|---------|------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `scan-type`       | String  | `image`                            | Scan type, e.g. `image` or `fs`                                                                 |
+| `scan-type`                  | String  | `image`                            | Scan type, e.g. `image` or `fs`                                                                                                                                |
-| `input`           | String  |                                    | Tar reference, e.g. `alpine-latest.tar`                                                         |
+| `input`                      | String  |                                    | Tar reference, e.g. `alpine-latest.tar`                                                                                                                        |
-| `image-ref`       | String  |                                    | Image reference, e.g. `alpine:3.10.2`                                                           |
+| `image-ref`                  | String  |                                    | Image reference, e.g. `alpine:3.10.2`                                                                                                                          |
-| `scan-ref`        | String  | `/github/workspace/`               | Scan reference, e.g. `/github/workspace/` or `.`                                                |
+| `scan-ref`                   | String  | `/github/workspace/`               | Scan reference, e.g. `/github/workspace/` or `.`                                                                                                               |
-| `format`          | String  | `table`                            | Output format (`table`, `json`, `sarif`, `github`)                                              |
+| `format`                     | String  | `table`                            | Output format (`table`, `json`, `sarif`, `github`)                                                                                                             |
-| `template`        | String  |                                    | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`)                                 |
+| `template`                   | String  |                                    | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`)                                                                                                |
-| `tf-vars`         | String  |                                    | path to Terraform variables file                                                                |
+| `tf-vars`                    | String  |                                    | path to Terraform variables file                                                                                                                               |
-| `output`          | String  |                                    | Save results to a file                                                                          |
+| `output`                     | String  |                                    | Save results to a file                                                                                                                                         |
-| `exit-code`       | String  | `0`                                | Exit code when specified vulnerabilities are found                                              |
+| `exit-code`                  | String  | `0`                                | Exit code when specified vulnerabilities are found                                                                                                             |
-| `ignore-unfixed`  | Boolean | false                              | Ignore unpatched/unfixed vulnerabilities                                                        |
+| `ignore-unfixed`             | Boolean | false                              | Ignore unpatched/unfixed vulnerabilities                                                                                                                       |
-| `vuln-type`       | String  | `os,library`                       | Vulnerability types (os,library)                                                                |
+| `vuln-type`                  | String  | `os,library`                       | Vulnerability types (os,library)                                                                                                                               |
-| `severity`        | String  | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed                                      |
+| `severity`                   | String  | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed                                                                                                     |
-| `skip-dirs`       | String  |                                    | Comma separated list of directories where traversal is skipped                                  |
+| `skip-dirs`                  | String  |                                    | Comma separated list of directories where traversal is skipped                                                                                                 |
-| `skip-files`      | String  |                                    | Comma separated list of files where traversal is skipped                                        |
+| `skip-files`                 | String  |                                    | Comma separated list of files where traversal is skipped                                                                                                       |
-| `cache-dir`       | String  |                                    | Cache directory                                                                                 |
+| `cache-dir`                  | String  |                                    | Cache directory                                                                                                                                                |
-| `timeout`         | String  | `5m0s`                             | Scan timeout duration                                                                           |
+| `timeout`                    | String  | `5m0s`                             | Scan timeout duration                                                                                                                                          |
-| `ignore-policy`   | String  |                                    | Filter vulnerabilities with OPA rego language                                                   |
+| `ignore-policy`              | String  |                                    | Filter vulnerabilities with OPA rego language                                                                                                                  |
-| `hide-progress`   | String  | `true`                             | Suppress progress bar                                                                           |
+| `hide-progress`              | String  | `true`                             | Suppress progress bar                                                                                                                                          |
-| `list-all-pkgs`   | String  |                                    | Output all packages regardless of vulnerability                                                 |
+| `list-all-pkgs`              | String  |                                    | Output all packages regardless of vulnerability                                                                                                                |
-| `scanners` | String  | `vuln,secret`                      | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`)               |
+| `scanners`                   | String  | `vuln,secret`                      | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`)                                                                              |
-| `trivyignores`    | String  |                                    | comma-separated list of relative paths in repository to one or more `.trivyignore` files        |
+| `trivyignores`               | String  |                                    | comma-separated list of relative paths in repository to one or more `.trivyignore` files                                                                       |
-| `trivy-config`    | String  |                                    | Path to trivy.yaml config                                                                       |
+| `trivy-config`               | String  |                                    | Path to trivy.yaml config                                                                                                                                      |
-| `github-pat`      | String  |                                    | Authentication token to enable sending SBOM scan results to GitHub Dependency Graph. Can be either a GitHub Personal Access Token (PAT) or GITHUB_TOKEN |
+| `github-pat`                 | String  |                                    | Authentication token to enable sending SBOM scan results to GitHub Dependency Graph. Can be either a GitHub Personal Access Token (PAT) or GITHUB_TOKEN        |
-| `limit-severities-for-sarif`      | Boolean  | false                                   | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
+| `limit-severities-for-sarif` | Boolean | false                              | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
+
+### Environment variables
+You can use [Trivy environment variables][trivy-env] to set the necessary options (including flags that are not supported by [Inputs](#inputs), such as `--secret-config`).
+
+### Trivy config file
+When using the `trivy-config` [Input](#inputs), you can set options using the [Trivy config file][trivy-config] (including flags that are not supported by [Inputs](#inputs), such as `--secret-config`).
 
 [release]: https://github.com/aquasecurity/trivy-action/releases/latest
 [release-img]: https://img.shields.io/github/release/aquasecurity/trivy-action.svg?logo=github
@@ -516,3 +574,5 @@ Following inputs can be used as `step.with` keys:
 [marketplace-img]: https://img.shields.io/badge/marketplace-trivy--action-blue?logo=github
 [license]: https://github.com/aquasecurity/trivy-action/blob/master/LICENSE
 [license-img]: https://img.shields.io/github/license/aquasecurity/trivy-action
+[trivy-env]: https://aquasecurity.github.io/trivy/latest/docs/configuration/#environment-variables
+[trivy-config]: https://aquasecurity.github.io/trivy/latest/docs/references/configuration/config-file/

entrypoint.sh

@@ -80,7 +80,7 @@ done
 
 scanType=$(echo $scanType | tr -d '\r')
 export artifactRef="${imageRef}"
-if [ "${scanType}" = "repo" ] || [ "${scanType}" = "fs" ] || [ "${scanType}" = "filesystem" ] ||  [ "${scanType}" = "config" ] ||  [ "${scanType}" = "rootfs" ];then
+if [ "${scanType}" = "repo" ] || [ "${scanType}" = "fs" ] || [ "${scanType}" = "filesystem" ] ||  [ "${scanType}" = "config" ] ||  [ "${scanType}" = "rootfs" ] || [ "${scanType}" = "sbom" ];then
   artifactRef=$(echo $scanRef | tr -d '\r')
 fi
 input=$(echo $input | tr -d '\r')
@@ -163,6 +163,7 @@ if [ $ignorePolicy ];then
 fi
 if [ "$hideProgress" == "true" ];then
   ARGS="$ARGS --no-progress"
+  SARIF_ARGS="$SARIF_ARGS --no-progress"
 fi
 
 listAllPkgs=$(echo $listAllPkgs | tr -d '\r')
@@ -173,6 +174,7 @@ if [ "$skipFiles" ];then
   for i in $(echo $skipFiles | tr "," "\n")
   do
     ARGS="$ARGS --skip-files $i"
+    SARIF_ARGS="$SARIF_ARGS --skip-files $i"
   done
 fi
 

test/data/config-sarif.test

@@ -307,7 +307,7 @@
               }
             }
           ],
-          "version": "0.48.0"
+          "version": "0.48.1"
         }
       },
       "results": [
@@ -612,7 +612,7 @@
       "columnKind": "utf16CodeUnits",
       "originalUriBaseIds": {
         "ROOTPATH": {
-          "uri": "file:///Users/simarpreetsingh/repos/trivy-action/"
+          "uri": "file:///home/runner/work/trivy-action/trivy-action/"
         }
       }
     }

test/data/config.test

@@ -1,6 +1,6 @@
 {
   "SchemaVersion": 2,
-  "CreatedAt": "2023-12-08T11:02:54.295987-07:00",
+  "CreatedAt": "2024-01-02T23:40:12.036390742Z",
   "ArtifactName": ".",
   "ArtifactType": "filesystem",
   "Metadata": {

test/data/fs-scheck.test

@@ -1,6 +1,6 @@
 {
   "SchemaVersion": 2,
-  "CreatedAt": "2023-12-08T11:02:56.571535-07:00",
+  "CreatedAt": "2024-01-02T23:40:15.166517221Z",
   "ArtifactName": ".",
   "ArtifactType": "filesystem",
   "Metadata": {

test/data/repo.test

@@ -1,6 +1,6 @@
 {
   "SchemaVersion": 2,
-  "CreatedAt": "2023-12-08T11:02:50.045151-07:00",
+  "CreatedAt": "2024-01-02T23:40:04.647712097Z",
   "ArtifactName": "https://github.com/krol3/demo-trivy/",
   "ArtifactType": "repository",
   "Metadata": {

test/data/tfvars.test

@@ -1,6 +1,6 @@
 {
   "SchemaVersion": 2,
-  "CreatedAt": "2023-12-08T11:03:02.76948-07:00",
+  "CreatedAt": "2024-01-02T16:27:32.841193-07:00",
   "ArtifactName": "test/data",
   "ArtifactType": "filesystem",
   "Metadata": {

test/data/yamlconfig.test

@@ -1,6 +1,6 @@
 {
   "SchemaVersion": 2,
-  "CreatedAt": "2023-12-08T11:03:01.877209-07:00",
+  "CreatedAt": "2024-01-02T23:40:21.039454971Z",
   "ArtifactName": "alpine:3.10",
   "ArtifactType": "container_image",
   "Metadata": {
@@ -106,8 +106,8 @@
             "https://nvd.nist.gov/vuln/detail/CVE-2021-36159",
             "https://www.cve.org/CVERecord?id=CVE-2021-36159"
           ],
-          "PublishedDate": "2021-08-03T14:15:00Z",
+          "PublishedDate": "2021-08-03T14:15:08.233Z",
-          "LastModifiedDate": "2023-11-07T03:36:00Z"
+          "LastModifiedDate": "2023-11-07T03:36:43.337Z"
         }
       ]
     }