xpeditis2.0/scripts/ci/summarize-image-security.py

"""Show actionable image findings even when the blocking Trivy step failed."""
import json
import os
from pathlib import Path


def summarize(path):
    try:
        report = json.loads(path.read_text())
        if not isinstance(report, dict) or not isinstance(report.get('Results'), list):
            raise ValueError('Missing scan results')
    except (OSError, ValueError):
        print('Image report missing or invalid: inspect the Trivy step; scan not verified.')
        return 1

    count = 0
    for result in report['Results']:
        for finding in result.get('Vulnerabilities') or []:
            if finding.get('Severity') not in ('HIGH', 'CRITICAL'):
                continue
            count += 1
            print(f'{finding["Severity"]} {finding.get("VulnerabilityID", "unknown")}: '
                  f'{finding.get("PkgName", "unknown")} '
                  f'{finding.get("InstalledVersion", "unknown")} -> '
                  f'{finding.get("FixedVersion") or "no fixed version published"}')
            print(f'  Path: {finding.get("PkgPath") or result.get("Target", "unknown")}')
    print(f'{count} HIGH/CRITICAL image findings. Full details: image-security artifact.')
    return int(count > 0)


if __name__ == '__main__':
    raise SystemExit(summarize(Path(os.environ['RUNNER_TEMP']) / 'image-security.json'))