build-labels 0.0.81 → 0.0.82

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 476e27617813a76b8dc23859333d42a05d7be58b318a565e20d6df009dc41b4d
-  data.tar.gz: e26ea40307746c5b3201fad92fe47a9ca57c489f9ec3b7dbe0aaa88094baa653
+  metadata.gz: f07b75a01ca8a9ba33efeab300c5fe83a04cf08548191ce1a80886802e18fdeb
+  data.tar.gz: 54a10a7de0eafb37faf74906c181c2ea9cba257e89ed4882688ba25e5794fe6b
 SHA512:
-  metadata.gz: 3f3f93bbe70d686fef054fca76c6238d2d2142147d1b0861183a779480fb81971499c177acf7779d03c15909582b98552cf9186e737ae448bf096a76cb64a584
-  data.tar.gz: a863e23dab5dc2ab15e462943e5cf24b25310f3b096929f02faac1038483e274545a58b49f671d489db896a6d285fb7573950266cb7458db69445cf3a4c45fd4
+  metadata.gz: 92aa39e035a072c5dbbfc6fce2fd67e6852dc6d9c94828307ae98bc5e0008d70ee73ebd48f391ade26800c0c926cf9bc66ec73a82bd2a0a8e1f173ece2f3427f
+  data.tar.gz: 5c7c36fd8dead4a7e9a1fae8f0edb4ad59e2656d7cbe0cc1487747220d370b28d870da15bd96ad04df71f016a6a532d1d254951754ba1fb7fefbf157f51aa8a9

data/lib/trivy-runner.rb

@@ -5,28 +5,23 @@ require 'yaml'
 require_relative 'version'
 
 class TrivyRunner
-  SEVERITIES = %w[UNKNOWN LOW MEDIUM HIGH CRITICAL].freeze
   IMAGE_ID = /\Asha256:[0-9a-f]{64}\z/
 
   def run(args)
     file = 'bake.yml'
     metadata_file = nil
-    severity = %w[HIGH CRITICAL]
     parser = OptionParser.new do |options|
-      options.banner = 'Usage: trivy-runner -f BAKE_FILE --metadata-file FILE [TARGET/GROUP ...]'
+      options.banner = 'Usage: trivy-runner -f BAKE_FILE --metadata-file FILE [TARGET/GROUP ...] [-- TRIVY_OPTIONS ...]'
+      options.separator 'Options after -- are forwarded to trivy image.'
       options.on('-f', '--file FILE', 'Bake or Compose file (default: bake.yml)') { file = _1 }
       options.on('--metadata-file FILE', 'Buildx metadata from the local build') { metadata_file = _1 }
       options.on('--image-src SOURCE', %w[docker], 'Image source (default: docker)')
-      options.on('--fail-on SEVERITIES', Array, 'Fail on these severities (default: HIGH,CRITICAL)') do |values|
-        severity = values.map { _1.strip.upcase }.uniq
-        if severity.empty? || (severity - SEVERITIES).any?
-          raise OptionParser::InvalidArgument, values.join(',')
-        end
-      end
       options.on('-v', '--version', 'Print version') { puts BuildLabels::Builder::VERSION; return 0 }
       options.on('-h', '--help', 'Print help') { puts options; return 0 }
     end
-    targets = parser.parse!(args.dup)
+    separator = args.index('--') || args.length
+    trivy_args = args.drop(separator + 1)
+    targets = parser.parse!(args.take(separator))
     raise OptionParser::MissingArgument, '--metadata-file' unless metadata_file
     return 0 if targets.empty? && empty_compose?(file)
 
@@ -37,7 +32,7 @@ class TrivyRunner
 
     verify_images(images)
     images.values.uniq.each do |image_id|
-      return 1 unless scan(image_id, severity)
+      return 1 unless scan(image_id, trivy_args)
     end
     verify_images(images)
     0
@@ -48,7 +43,7 @@ class TrivyRunner
 
   private
 
-  def scan(image_id, severity)
+  def scan(image_id, trivy_args)
     environment = ENV.keys.grep(/\ATRIVY_/) - %w[TRIVY_IMAGE]
     cache_dir = ENV.fetch('TRIVY_CACHE_DIR', '/root/.cache/trivy')
     system('docker', 'run', '--rm', '--pull', 'always',
@@ -56,7 +51,7 @@ class TrivyRunner
            '--mount', "type=volume,src=trivy-cache,dst=#{cache_dir}",
            *environment.flat_map { ['--env', _1] }, ENV.fetch('TRIVY_IMAGE', 'aquasec/trivy'),
            'image', '--cache-dir', cache_dir, '--image-src', 'docker', '--scanners', 'vuln',
-           '--severity', severity.join(','), '--exit-code', '1', image_id)
+           '--exit-code', '1', *trivy_args, image_id)
   end
 
   def empty_compose?(file)

data/lib/version.rb

@@ -1,5 +1,5 @@
 module BuildLabels
   class Builder
-    VERSION = '0.0.81'
+    VERSION = '0.0.82'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: build-labels
 version: !ruby/object:Gem::Version
-  version: 0.0.81
+  version: 0.0.82
 platform: ruby
 authors:
 - Artyom B