@codacy/tools-trivy-0 0.23.1 → 0.25.0

package/README.md

@@ -12,6 +12,7 @@
   - [Known divergences](#known-divergences)
 - [DB update management](#db-update-management)
 - [Malicious package detection](#malicious-package-detection)
+- [Container image mode](#container-image-mode)
 - [Updating patterns](#updating-patterns)
 - [Updating the Trivy version](#updating-the-trivy-version)
 - [Development](#development)
@@ -177,6 +178,34 @@ is extracted and cross-referenced against the OpenSSF malicious packages index (
 - On API failure (network error, timeout), logs a warning and skips — never blocks the core scan
 - Message format: `Malicious package detected: {name}@{version} ({MAL-ID}). {summary}`
 
+## Container image mode
+
+Besides the repository scan, the adapter implements the optional `containerImage` capability
+(`src/image.ts`), which backs the CLI's `container-scan` and `upload-sbom` commands. The descriptor
+advertises it with `scansContainerImages: true`.
+
+| Method         | Invocation                                                                                                                                               |
+| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scan`         | `trivy image --format json --cache-dir … [--skip-db-update --skip-java-db-update] --scanners vuln [--ignore-unfixed] --severity … --pkg-types … <image>` |
+| `generateSbom` | `trivy image --format cyclonedx\|spdx-json --output <path> --cache-dir … <image>`                                                                        |
+
+- The image reference is re-validated with `validateImageReference` right before it becomes an argv
+  element, even though the runner validated it first.
+- `--exit-code` is deliberately **not** passed. The finding count comes from the parsed JSON, so any
+  non-zero exit is a real failure — no stderr heuristics like cli-v2's to decide _whether_ it failed.
+- Findings reuse `describeVulnerability` (`src/findings.ts`), the same mapping the repository scan
+  uses: umbrella pattern by severity, `codacy-trivy`'s message format, CVE as `sourceId`, `UNKNOWN`
+  dropped. The location is Trivy's `Target` (the OS layer or an in-image manifest) at line 1.
+- `generateSbom` succeeds only if Trivy exits 0 **and** wrote a non-empty file.
+- Every Trivy spawn (both modes) sets `TRIVY_SKIP_VERSION_CHECK=true`, and a failure's stderr goes
+  through `summarizeTrivyStderr` (`src/trivy-errors.ts`) rather than being echoed: Trivy's stderr is
+  a log stream (INFO lines, an ANSI version notice, then a FATAL Go error-wrap chain), and the text
+  formatter truncates errors at 240 characters, which used to cut it off before the cause. The env
+  var rather than `--skip-version-check`, because an older global Trivy would reject the flag.
+- `test/fixtures/image-scan.json` is trimmed from a real `trivy image` run against
+  `nginx:1.21.0-alpine`, plus one synthetic `UNKNOWN` finding and one synthetic library finding.
+  `CODACY_TRIVY_IMAGE_IT=1 pnpm test` runs the opt-in integration test against the real registry.
+
 ## Updating patterns
 
 ```bash
@@ -189,7 +218,7 @@ git add src/patterns.json
 
 ## Updating the Trivy version
 
-1. Update `preferredVersion` in `src/adapter.ts`
+1. Update `preferredVersion` in `src/metadata.ts`
 2. Update the download URL template if the release format changed
 3. Run `pnpm test` to verify compatibility
 

package/dist/index.js

@@ -233,18 +233,19 @@ var patterns_default = [
 // src/metadata.ts
 var descriptor = {
   id: "Trivy",
+  shortName: "trivy",
   displayName: "Trivy",
   preferredVersion: "0.72.0",
   languages: [
     "Python",
-    "JavaScript",
+    "Javascript",
     "TypeScript",
     "Go",
     "Java",
     "Ruby",
     "Rust",
     "PHP",
-    "C#",
+    "CSharp",
     "Dart",
     "Elixir",
     "Swift"
@@ -257,7 +258,9 @@ var descriptor = {
   // issues must upload `sourceId` (the CVE id) or two CVEs on the same manifest
   // line collapse into a single Codacy result. Matches `needs_source_id_upload`
   // in the Go CLI's Trivy plugin manifest.
-  needsSourceIdUpload: true
+  needsSourceIdUpload: true,
+  // Implements `containerImage` (`trivy image`) for `container-scan` / `upload-sbom`.
+  scansContainerImages: true
 };
 
 // src/vuln-mapping.ts
@@ -366,8 +369,7 @@ function comparePrerelease(x, y) {
   return xs.length < ys.length ? -1 : 1;
 }
 
-// src/adapter.ts
-var TOOL_ID = "Trivy";
+// src/findings.ts
 var PATTERN_META = new Map(
   patterns_default.map((p) => [
     p.id,
@@ -383,6 +385,158 @@ var VULN_SEVERITY_TO_PATTERN = {
   MEDIUM: "Trivy_vulnerability_medium",
   LOW: "Trivy_vulnerability_minor"
 };
+function describeVulnerability(vuln) {
+  const patternId = VULN_SEVERITY_TO_PATTERN[vuln.Severity];
+  if (!patternId) return void 0;
+  const meta = PATTERN_META.get(patternId) ?? {
+    category: "Security",
+    severity: "Info"
+  };
+  const fixedVersion = findLeastDisruptiveFixedVersion(
+    vuln.InstalledVersion,
+    vuln.FixedVersion ?? ""
+  );
+  const fix = fixedVersion ? `(update to ${fixedVersion})` : "(no fix available)";
+  const purl = vuln.PkgIdentifier?.PURL;
+  const pkgLabel = purl ? purlPrettyPrint(purl) : `${vuln.PkgName}@${vuln.InstalledVersion}`;
+  return {
+    patternId,
+    message: `Insecure dependency ${pkgLabel} (${vuln.VulnerabilityID}: ${vuln.Title ?? ""}) ${fix}`,
+    category: meta.category,
+    severity: meta.severity,
+    ...vuln.VulnerabilityID ? { sourceId: vuln.VulnerabilityID } : {}
+  };
+}
+
+// src/image.ts
+function buildImageScanArgs(base, options) {
+  const args = [
+    "image",
+    "--format",
+    "json",
+    "--cache-dir",
+    base.cacheDir,
+    ...dbUpdateArgs(base),
+    "--scanners",
+    "vuln"
+  ];
+  if (options.ignoreUnfixed) args.push("--ignore-unfixed");
+  args.push("--severity", options.severities.join(","));
+  args.push("--pkg-types", options.pkgTypes.join(","));
+  args.push(options.image);
+  return args;
+}
+function buildSbomArgs(base, options) {
+  return [
+    "image",
+    "--format",
+    options.format,
+    "--output",
+    options.outputPath,
+    "--cache-dir",
+    base.cacheDir,
+    options.image
+  ];
+}
+function dbUpdateArgs(base) {
+  return base.skipDbUpdate ? ["--skip-db-update", "--skip-java-db-update"] : [];
+}
+function parseImageVulnerabilities(output, toolId) {
+  const issues = [];
+  for (const result of output.Results ?? []) {
+    for (const vuln of result.Vulnerabilities ?? []) {
+      const described = describeVulnerability(vuln);
+      if (!described) continue;
+      issues.push({
+        ...described,
+        filePath: result.Target,
+        toolId,
+        line: 1,
+        column: 1,
+        lineContent: ""
+      });
+    }
+  }
+  return issues;
+}
+
+// src/trivy-errors.ts
+var TRIVY_ENV = { TRIVY_SKIP_VERSION_CHECK: "true" };
+function stripAnsi(text) {
+  return text.replace(/\x1b\[[0-9;]*[A-Za-z]/g, "");
+}
+var WRAPPER_PREFIXES = [
+  /^run error:\s*/i,
+  /^(?:image|fs|filesystem|repository|rootfs|sbom|vm) scan error:\s*/i,
+  /^scan error:\s*/i,
+  /^unable to initialize (?:a scan service|artifact|container image):\s*/i
+];
+function stripWrappers(chain) {
+  let current = chain.trim();
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const prefix of WRAPPER_PREFIXES) {
+      const next = current.replace(prefix, "");
+      if (next !== current) {
+        current = next;
+        changed = true;
+      }
+    }
+  }
+  return current;
+}
+function summarizeTrivyStderr(stderr) {
+  const text = stripAnsi(stderr);
+  const lines = text.split(/\r?\n/);
+  const fatalIndex = lines.findIndex((l) => /\tFATAL\t|\sFATAL\s/.test(l));
+  if (fatalIndex !== -1) {
+    const chain = lines[fatalIndex].replace(/^.*?\bFATAL\s+(?:Fatal error\s+)?/, "");
+    const details = lines.slice(fatalIndex + 1).map((l) => l.trim());
+    const missing = chain.match(/unable to find the specified image "([^"]+)"/);
+    if (missing) {
+      const remote = details.find((l) => /^\*\s*remote error:/i.test(l))?.replace(/^\*\s*remote error:\s*/i, "");
+      const base = `Image "${missing[1]}" not found locally (Docker, containerd, Podman) or in its registry`;
+      if (!remote) return base;
+      if (/UNAUTHORIZED|authentication required|denied/i.test(remote)) {
+        return `${base}: access denied \u2014 the image or tag does not exist, or it is private and needs a registry login`;
+      }
+      return `${base}: ${remote.replace(/\s*\[map\[.*$/, "")}`;
+    }
+    return stripWrappers(chain).replace(/:\s*\d+ errors? occurred:?$/i, "");
+  }
+  return withoutNoise(lines).join(" ");
+}
+var TIMESTAMPED = /^\d{4}-\d{2}-\d{2}T\S+\s+/;
+var QUIET_LOG_LINE = /^\d{4}-\d{2}-\d{2}T\S+\s+(?:DEBUG|INFO)\b/;
+function withoutNoise(lines) {
+  const kept = [];
+  let inNotice = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (/Notices:/.test(line)) {
+      inNotice = true;
+      continue;
+    }
+    if (inNotice) {
+      if (/--skip-version-check/.test(line)) {
+        inNotice = false;
+        continue;
+      }
+      if (!TIMESTAMPED.test(line)) continue;
+      inNotice = false;
+    }
+    if (line.length === 0 || QUIET_LOG_LINE.test(line)) continue;
+    kept.push(line.replace(TIMESTAMPED, "").replace(/\t/g, " "));
+  }
+  return kept;
+}
+function trivyExitMessage(exitCode, stderr) {
+  return summarizeTrivyStderr(stderr) || `trivy exited with code ${exitCode}`;
+}
+
+// src/adapter.ts
+var TOOL_ID = "Trivy";
 var PATTERN_TO_SEVERITY = {
   Trivy_vulnerability_critical: "CRITICAL",
   Trivy_vulnerability_high: "HIGH",
@@ -443,7 +597,11 @@ var PLATFORM_MAP = {
   "linux-arm64": "Linux-ARM64",
   // Windows ships a `.zip` (trivy_{version}_windows-64bit.zip) with `trivy.exe`
   // at the archive root — handled in install (extension + exeName).
-  "win32-x64": "windows-64bit"
+  "win32-x64": "windows-64bit",
+  // Trivy publishes no Windows ARM64 build; Windows on ARM runs the x64 binary
+  // under emulation, so use it rather than reporting the platform unsupported
+  // (the descriptor already declares arm64).
+  "win32-arm64": "windows-64bit"
 };
 async function getVersionFromBinary(binaryPath) {
   try {
@@ -486,14 +644,18 @@ async function checkDbFreshness(cacheDir) {
     return { fresh: false, error: message };
   }
 }
-async function runTrivyScan(binary, args, cwd, errors) {
-  const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, { cwd });
+async function runTrivyScan(binary, args, cwd, errors, spawnOptions = {}) {
+  const { stdout, stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, {
+    cwd,
+    env: TRIVY_ENV,
+    ...spawnOptions
+  });
   if (exitCode !== 0) {
     errors.push({
       toolId: TOOL_ID,
       phase: "toolInvoke",
       kind: "NonZeroExit",
-      message: `trivy exited with code ${exitCode}${stderr ? `: ${stderr.trim()}` : ""}`,
+      message: trivyExitMessage(exitCode, stderr),
       level: "error"
     });
     return null;
@@ -514,7 +676,6 @@ async function runTrivyScan(binary, args, cwd, errors) {
     return null;
   }
 }
-var LINE_NUMBERS_NOT_SUPPORTED = "Line numbers not supported";
 function recordUnlocatableFinding(errors, seenFiles, filePath) {
   if (seenFiles.has(filePath)) return;
   seenFiles.add(filePath);
@@ -522,9 +683,10 @@ function recordUnlocatableFinding(errors, seenFiles, filePath) {
     toolId: TOOL_ID,
     phase: "outputParse",
     kind: "LineNumbersNotSupported",
-    message: LINE_NUMBERS_NOT_SUPPORTED,
+    message: import_tooling.LINE_NUMBERS_NOT_SUPPORTED,
     level: "warning",
-    filePath
+    filePath,
+    fileNotAnalyzed: true
   });
 }
 async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, repositoryRoot, unlocatableFiles) {
@@ -556,13 +718,9 @@ async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, rep
       return found;
     };
     for (const vuln of result.Vulnerabilities) {
-      const patternId = VULN_SEVERITY_TO_PATTERN[vuln.Severity];
-      if (!patternId) continue;
-      if (enabledPatterns.size > 0 && !enabledPatterns.has(patternId)) continue;
-      const meta = PATTERN_META.get(patternId) ?? {
-        category: "Security",
-        severity: "Info"
-      };
+      const described = describeVulnerability(vuln);
+      if (!described) continue;
+      if (enabledPatterns.size > 0 && !enabledPatterns.has(described.patternId)) continue;
       const purl = vuln.PkgIdentifier?.PURL;
       const reportedLine = (purl !== void 0 ? lineByPurl.get(purl) : void 0) ?? (vuln.PkgID !== void 0 ? lineByPkgId.get(vuln.PkgID) : void 0) ?? 0;
       const line = reportedLine > 0 ? reportedLine : resolveFallbackLine(vuln.PkgName);
@@ -570,23 +728,13 @@ async function parseVulnerabilities(output, enabledPatterns, targetFilesSet, rep
         recordUnlocatableFinding(errors, unlocatableFiles, relPath);
         continue;
       }
-      const fixedVersion = findLeastDisruptiveFixedVersion(
-        vuln.InstalledVersion,
-        vuln.FixedVersion ?? ""
-      );
-      const fix = fixedVersion ? `(update to ${fixedVersion})` : "(no fix available)";
-      const pkgLabel = purl ? purlPrettyPrint(purl) : `${vuln.PkgName}@${vuln.InstalledVersion}`;
       issues.push({
+        ...described,
         filePath: relPath,
-        patternId,
         toolId: TOOL_ID,
         line,
         column: 1,
-        message: `Insecure dependency ${pkgLabel} (${vuln.VulnerabilityID}: ${vuln.Title ?? ""}) ${fix}`,
-        lineContent: (0, import_tooling.getLineContent)(lines, line),
-        category: meta.category,
-        severity: meta.severity,
-        ...vuln.VulnerabilityID ? { sourceId: vuln.VulnerabilityID } : {}
+        lineContent: (0, import_tooling.getLineContent)(lines, line)
       });
     }
   }
@@ -737,12 +885,101 @@ async function parseMaliciousPackages(output, enabledPatterns, targetFilesSet, r
   logger.info("Malicious package check complete", { issuesFound: issues.length });
   return { issues, errors };
 }
+async function scanImage(ctx, options) {
+  const startedAt = /* @__PURE__ */ new Date();
+  const errors = [];
+  const fail = (kind, message) => {
+    errors.push({ toolId: TOOL_ID, phase: "toolInvoke", kind, message, level: "error" });
+    const result = (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), [], errors, 0);
+    return { ...result, summary: { ...result.summary, status: "failed" } };
+  };
+  try {
+    (0, import_tooling.validateImageReference)(options.image);
+  } catch (err) {
+    return fail("InvalidImageReference", errorMessage(err));
+  }
+  ctx.logger.info("Starting image scan", { toolId: TOOL_ID, image: options.image });
+  try {
+    const binary = await resolveBinaryPath(ctx);
+    const cacheDir = await ensureCacheDir(ctx.globalDir);
+    const skipDbUpdate = await shouldSkipDbUpdate(ctx, cacheDir);
+    const args = buildImageScanArgs({ cacheDir, skipDbUpdate }, options);
+    const output = await runTrivyScan(binary, args, ctx.repositoryRoot, errors, {
+      signal: ctx.signal,
+      logger: ctx.logger
+    });
+    if (!output) {
+      const result = (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), [], errors, 0);
+      return { ...result, summary: { ...result.summary, status: "failed" } };
+    }
+    const issues = parseImageVulnerabilities(output, TOOL_ID);
+    ctx.logger.info("Image scan complete", { toolId: TOOL_ID, issueCount: issues.length });
+    return (0, import_tooling.buildResult)(TOOL_ID, startedAt, /* @__PURE__ */ new Date(), issues, errors, 1);
+  } catch (err) {
+    if (ctx.signal?.aborted) return fail("Cancelled", "Image scan cancelled by caller");
+    return fail("InvocationError", `Failed to run trivy: ${errorMessage(err)}`);
+  }
+}
+async function generateImageSbom(ctx, options) {
+  const failure = (kind, message) => ({
+    success: false,
+    error: { toolId: TOOL_ID, phase: "toolInvoke", kind, message, level: "error" }
+  });
+  try {
+    (0, import_tooling.validateImageReference)(options.image);
+  } catch (err) {
+    return failure("InvalidImageReference", errorMessage(err));
+  }
+  try {
+    const binary = await resolveBinaryPath(ctx);
+    const cacheDir = await ensureCacheDir(ctx.globalDir);
+    const args = buildSbomArgs({ cacheDir }, options);
+    ctx.logger.info("Generating SBOM", { toolId: TOOL_ID, image: options.image });
+    const { stderr, exitCode } = await (0, import_tooling.spawnTool)(binary, args, {
+      cwd: ctx.repositoryRoot,
+      env: TRIVY_ENV,
+      logger: ctx.logger,
+      signal: ctx.signal
+    });
+    if (exitCode !== 0) {
+      return failure("NonZeroExit", trivyExitMessage(exitCode, stderr));
+    }
+    const stat = await import_promises.default.stat(options.outputPath).catch(() => null);
+    if (!stat || stat.size === 0) {
+      return failure(
+        "MissingOutput",
+        `trivy exited cleanly but wrote no SBOM to ${options.outputPath}`
+      );
+    }
+    return { success: true };
+  } catch (err) {
+    if (ctx.signal?.aborted) return failure("Cancelled", "SBOM generation cancelled by caller");
+    return failure("InvocationError", `Failed to run trivy: ${errorMessage(err)}`);
+  }
+}
+async function shouldSkipDbUpdate(ctx, cacheDir) {
+  if (ctx.runner === "container") return true;
+  const status = await checkDbFreshness(cacheDir);
+  if (!status.fresh) {
+    ctx.logger.info(
+      status.error?.includes("ENOENT") ? "Trivy vulnerability database not found. Downloading (~40MB)..." : "Trivy DB update due, checking for new data..."
+    );
+  }
+  return status.fresh;
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 var adapter = {
   ...descriptor,
   patternsMetadata: patterns_default,
   compatibleVersions: ">=0.50.0",
   website: "https://trivy.dev/",
   prerequisites: [],
+  containerImage: {
+    scan: scanImage,
+    generateSbom: generateImageSbom
+  },
   /**
    * Checks whether the `trivy` binary is present and runnable.
    *
@@ -789,8 +1026,9 @@ var adapter = {
   /**
    * Downloads trivy from GitHub releases and extracts it to ctx.toolInstallDir.
    *
-   * Detects the current platform/arch and downloads the appropriate tar.gz archive.
-   * Sets executable permission after extraction.
+   * Detects the current platform/arch and downloads the matching archive
+   * (`.zip` on Windows, `.tar.gz` elsewhere). Sets executable permission after
+   * extraction (not needed on Windows).
    */
   async install(ctx) {
     ctx.logger.info("Starting install", { toolId: TOOL_ID });
@@ -809,7 +1047,7 @@ var adapter = {
       };
     }
     const version = adapter.preferredVersion;
-    const archiveExt = import_tooling.IS_WINDOWS ? "zip" : "tar.gz";
+    const archiveExt = ctx.platform.os === "win32" ? "zip" : "tar.gz";
     const url = `https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_${platformSuffix}.${archiveExt}`;
     const destPath = import_path.default.join(ctx.toolInstallDir, (0, import_tooling.exeName)(BINARY));
     try {

package/dist/metadata.js

@@ -25,18 +25,19 @@ __export(metadata_exports, {
 module.exports = __toCommonJS(metadata_exports);
 var descriptor = {
   id: "Trivy",
+  shortName: "trivy",
   displayName: "Trivy",
   preferredVersion: "0.72.0",
   languages: [
     "Python",
-    "JavaScript",
+    "Javascript",
     "TypeScript",
     "Go",
     "Java",
     "Ruby",
     "Rust",
     "PHP",
-    "C#",
+    "CSharp",
     "Dart",
     "Elixir",
     "Swift"
@@ -49,7 +50,9 @@ var descriptor = {
   // issues must upload `sourceId` (the CVE id) or two CVEs on the same manifest
   // line collapse into a single Codacy result. Matches `needs_source_id_upload`
   // in the Go CLI's Trivy plugin manifest.
-  needsSourceIdUpload: true
+  needsSourceIdUpload: true,
+  // Implements `containerImage` (`trivy image`) for `container-scan` / `upload-sbom`.
+  scansContainerImages: true
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-trivy-0",
-  "version": "0.23.1",
+  "version": "0.25.0",
   "description": "Trivy adapter — CLI-mode security scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -8,7 +8,7 @@
     "dist"
   ],
   "dependencies": {
-    "@codacy/tooling": "0.23.1"
+    "@codacy/tooling": "0.25.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",