build-labels 0.0.79 → 0.0.80

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eab2ff4b6f31c2174bfd1febbc333d15a77ee0dee520c9890425a53b1b68d13a
-  data.tar.gz: c92078aa2fcaa417ffa8e12f9a0923c541b4922f6f17187245a066f5b401279a
+  metadata.gz: 85c6a279190386fdb2b18065e676e640484c5ce4b2f4fe3b3de8597bb81214a8
+  data.tar.gz: 419d06b5f33b03d79312022cc7ee4df622d2bcca99474177481d131890cdfa6f
 SHA512:
-  metadata.gz: 370bddb89fe5dd3d97275e4722caefaa0d6f097dd28dc846e5ee29acffd9422a71d2c3f0b24642a0e3321f2c3b7e34c352d49de60ee698481a5ed37d45e4bd9f
-  data.tar.gz: 19f3f0758ef096f40511153f0c430db56b1d6806b4437da2b9f46e3a24ec39c390a7783dcafcba12e23c6bd379aed14b84c49d89e92c9c9d5a0de7f24bddcb67
+  metadata.gz: f915e25af163403dd28199c99cd08d1acac593d780bdd7fd3841028e567c6944342ebbe9a6198d05586ab2f70c02bf19d547d24eb0f5a0e4fc240eec8fdafaa1
+  data.tar.gz: 9c45b412e6622ac2bc9aa528ef8fb0cb0e13d9c8663cfe85f8e3b9b00c85d186c392455f515a9c38fd53fda4ea68421bb12e1e6c066cab531dacf2e7e8e18d3a

data/bin/trivy-runner

@@ -0,0 +1,5 @@
+#!/usr/bin/env ruby
+
+require_relative '../lib/trivy-runner'
+
+exit TrivyRunner.new.run(ARGV)

data/lib/trivy-runner.rb

@@ -0,0 +1,93 @@
+require 'json'
+require 'open3'
+require 'optparse'
+require 'yaml'
+require_relative 'version'
+
+class TrivyRunner
+  SEVERITIES = %w[UNKNOWN LOW MEDIUM HIGH CRITICAL].freeze
+  IMAGE_ID = /\Asha256:[0-9a-f]{64}\z/
+
+  def run(args)
+    file = 'bake.yml'
+    metadata_file = nil
+    severity = %w[HIGH CRITICAL]
+    parser = OptionParser.new do |options|
+      options.banner = 'Usage: trivy-runner -f BAKE_FILE --metadata-file FILE [TARGET/GROUP ...]'
+      options.on('-f', '--file FILE', 'Bake or Compose file (default: bake.yml)') { file = _1 }
+      options.on('--metadata-file FILE', 'Buildx metadata from the local build') { metadata_file = _1 }
+      options.on('--image-src SOURCE', %w[docker], 'Image source (default: docker)')
+      options.on('--fail-on SEVERITIES', Array, 'Fail on these severities (default: HIGH,CRITICAL)') do |values|
+        severity = values.map { _1.strip.upcase }.uniq
+        if severity.empty? || (severity - SEVERITIES).any?
+          raise OptionParser::InvalidArgument, values.join(',')
+        end
+      end
+      options.on('-v', '--version', 'Print version') { puts BuildLabels::Builder::VERSION; return 0 }
+      options.on('-h', '--help', 'Print help') { puts options; return 0 }
+    end
+    targets = parser.parse!(args.dup)
+    raise OptionParser::MissingArgument, '--metadata-file' unless metadata_file
+    return 0 if targets.empty? && empty_compose?(file)
+
+    metadata = JSON.parse(File.read(metadata_file))
+    plan = capture_json('docker', 'buildx', 'bake', '-f', file, '--print', '--', *targets)
+    images = image_tags(plan.fetch('target'), metadata)
+    return 0 if images.empty?
+
+    verify_images(images)
+    images.values.uniq.each do |image_id|
+      return 1 unless system('trivy', 'image', '--image-src', 'docker', '--scanners', 'vuln',
+                             '--severity', severity.join(','), '--exit-code', '1', image_id)
+    end
+    verify_images(images)
+    0
+  rescue StandardError => error
+    warn error.message
+    1
+  end
+
+  private
+
+  def empty_compose?(file)
+    document = YAML.safe_load(File.read(file), aliases: true)
+    document.is_a?(Hash) && document['services'] == {}
+  rescue Psych::Exception
+    false
+  end
+
+  def image_tags(targets, metadata)
+    raise 'Invalid Bake target map' unless targets.is_a?(Hash)
+
+    images = {}
+    targets.each do |name, target|
+      raise "Multiple platforms for target: #{name}" if (target['platforms'] || []).size > 1
+
+      image_id = metadata.fetch(name).fetch('containerimage.config.digest')
+      raise "Invalid image ID for target: #{name}" unless image_id.is_a?(String) && IMAGE_ID.match?(image_id)
+
+      tags = target.fetch('tags')
+      raise "Missing image tags for target: #{name}" unless tags.is_a?(Array) && !tags.empty?
+
+      tags.each do |tag|
+        raise "Invalid image tag for target: #{name}" unless tag.is_a?(String) && !tag.empty?
+        raise "Conflicting image tag: #{tag}" if images.key?(tag) && images[tag] != image_id
+
+        images[tag] = image_id
+      end
+    end
+    images
+  end
+
+  def verify_images(images)
+    actual = capture_json('docker', 'image', 'inspect', '--', *images.keys).map { _1.fetch('Id') }
+    raise 'Image tags do not match build metadata' unless actual == images.values
+  end
+
+  def capture_json(*command)
+    output, status = Open3.capture2(*command)
+    raise "#{command.first} failed with status #{status.exitstatus}" unless status.success?
+
+    JSON.parse(output)
+  end
+end

data/lib/version.rb

@@ -1,5 +1,5 @@
 module BuildLabels
   class Builder
-    VERSION = '0.0.79'
+    VERSION = '0.0.80'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: build-labels
 version: !ruby/object:Gem::Version
-  version: 0.0.79
+  version: 0.0.80
 platform: ruby
 authors:
 - Artyom B
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-25 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -99,6 +99,7 @@ email: author@email.address
 executables:
 - build-labels
 - helm-push
+- trivy-runner
 - install-docker-static
 extensions: []
 extra_rdoc_files: []
@@ -106,6 +107,7 @@ files:
 - bin/build-labels
 - bin/helm-push
 - bin/install-docker-static
+- bin/trivy-runner
 - examples/Dockerfile
 - examples/common-compose.yml
 - examples/simple-compose.yml
@@ -124,6 +126,7 @@ files:
 - lib/helm-push.rb
 - lib/helm-push/command_line.rb
 - lib/helm-push/command_push.rb
+- lib/trivy-runner.rb
 - lib/version.rb
 homepage: https://rubygems.org/gems/build-labels
 licenses: