build-labels 0.0.81 → 0.0.83

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 476e27617813a76b8dc23859333d42a05d7be58b318a565e20d6df009dc41b4d
-  data.tar.gz: e26ea40307746c5b3201fad92fe47a9ca57c489f9ec3b7dbe0aaa88094baa653
+  metadata.gz: adfc440fd1f54d1424774cf6377a3b30707f3abf462685f26fdae9d95741a423
+  data.tar.gz: e0a4992ef8ef86adb7c66014fc55a4056a60ca6cc8158dfb3f872a58db4f5cae
 SHA512:
-  metadata.gz: 3f3f93bbe70d686fef054fca76c6238d2d2142147d1b0861183a779480fb81971499c177acf7779d03c15909582b98552cf9186e737ae448bf096a76cb64a584
-  data.tar.gz: a863e23dab5dc2ab15e462943e5cf24b25310f3b096929f02faac1038483e274545a58b49f671d489db896a6d285fb7573950266cb7458db69445cf3a4c45fd4
+  metadata.gz: 11de26c783203088ca06003f996122260c816a1a38e67cbe58cde402580a266bd94f1cffbe67d96ca00b2e0e448ebbd68ef7c2184ae8319cf7177985078d9244
+  data.tar.gz: fe69374c18692ca262fa1252e626344529a1e75f3e49d126c7768bde01c626e42df46ac581ae19982ad23a598946d843a69d8e1d9f7b4eddaec0d76699f62650

data/lib/trivy-runner.rb

@@ -5,28 +5,25 @@ require 'yaml'
 require_relative 'version'
 
 class TrivyRunner
-  SEVERITIES = %w[UNKNOWN LOW MEDIUM HIGH CRITICAL].freeze
   IMAGE_ID = /\Asha256:[0-9a-f]{64}\z/
 
   def run(args)
     file = 'bake.yml'
     metadata_file = nil
-    severity = %w[HIGH CRITICAL]
+    tty = true
     parser = OptionParser.new do |options|
-      options.banner = 'Usage: trivy-runner -f BAKE_FILE --metadata-file FILE [TARGET/GROUP ...]'
+      options.banner = 'Usage: trivy-runner -f BAKE_FILE --metadata-file FILE [TARGET/GROUP ...] [-- TRIVY_OPTIONS ...]'
+      options.separator 'Options after -- are forwarded to trivy image.'
       options.on('-f', '--file FILE', 'Bake or Compose file (default: bake.yml)') { file = _1 }
       options.on('--metadata-file FILE', 'Buildx metadata from the local build') { metadata_file = _1 }
       options.on('--image-src SOURCE', %w[docker], 'Image source (default: docker)')
-      options.on('--fail-on SEVERITIES', Array, 'Fail on these severities (default: HIGH,CRITICAL)') do |values|
-        severity = values.map { _1.strip.upcase }.uniq
-        if severity.empty? || (severity - SEVERITIES).any?
-          raise OptionParser::InvalidArgument, values.join(',')
-        end
-      end
+      options.on('--[no-]tty', 'Enable terminal output and Trivy table colors (default: enabled)') { tty = _1 }
       options.on('-v', '--version', 'Print version') { puts BuildLabels::Builder::VERSION; return 0 }
       options.on('-h', '--help', 'Print help') { puts options; return 0 }
     end
-    targets = parser.parse!(args.dup)
+    separator = args.index('--') || args.length
+    trivy_args = args.drop(separator + 1)
+    targets = parser.parse!(args.take(separator))
     raise OptionParser::MissingArgument, '--metadata-file' unless metadata_file
     return 0 if targets.empty? && empty_compose?(file)
 
@@ -36,10 +33,12 @@ class TrivyRunner
     return 0 if images.empty?
 
     verify_images(images)
-    images.values.uniq.each do |image_id|
-      return 1 unless scan(image_id, severity)
+    images.group_by { |_, image_id| image_id }.each do |image_id, entries|
+      warn "\n\e[36m=== Trivy scan: #{entries.map(&:first).join(', ')} ===\nImage ID: #{image_id}\e[0m"
+      return 1 unless scan(image_id, trivy_args, tty)
     end
     verify_images(images)
+    warn "\e[32mTrivy checks passed.\e[0m"
     0
   rescue StandardError => error
     warn error.message
@@ -48,15 +47,15 @@ class TrivyRunner
 
   private
 
-  def scan(image_id, severity)
+  def scan(image_id, trivy_args, tty)
     environment = ENV.keys.grep(/\ATRIVY_/) - %w[TRIVY_IMAGE]
     cache_dir = ENV.fetch('TRIVY_CACHE_DIR', '/root/.cache/trivy')
-    system('docker', 'run', '--rm', '--pull', 'always',
+    system('docker', 'run', '--rm', '--pull', 'always', *(tty ? ['--tty'] : []),
            '--mount', 'type=bind,src=/var/run/docker.sock,dst=/var/run/docker.sock,readonly',
            '--mount', "type=volume,src=trivy-cache,dst=#{cache_dir}",
            *environment.flat_map { ['--env', _1] }, ENV.fetch('TRIVY_IMAGE', 'aquasec/trivy'),
            'image', '--cache-dir', cache_dir, '--image-src', 'docker', '--scanners', 'vuln',
-           '--severity', severity.join(','), '--exit-code', '1', image_id)
+           '--exit-code', '1', *trivy_args, image_id)
   end
 
   def empty_compose?(file)

data/lib/version.rb

@@ -1,5 +1,5 @@
 module BuildLabels
   class Builder
-    VERSION = '0.0.81'
+    VERSION = '0.0.83'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: build-labels
 version: !ruby/object:Gem::Version
-  version: 0.0.81
+  version: 0.0.83
 platform: ruby
 authors:
 - Artyom B