mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-27 07:03:17 +08:00
alangou
3693b32841
* ci(trivy): add artifact and PR configuration scans Signed-off-by: Adrien Langou <alangou@nvidia.com> * fix(ci): harden Trivy gate detection and finding diff Signed-off-by: Adrien Langou <alangou@nvidia.com> * feat(ci): scan released artifacts in release pipelines Signed-off-by: Adrien Langou <alangou@nvidia.com> * fix(ci): harden and simplify Trivy scans Signed-off-by: Adrien Langou <alangou@nvidia.com> * fix(ci): consolidate Trivy reports and prevent collisions Signed-off-by: Adrien Langou <alangou@nvidia.com> --------- Signed-off-by: Adrien Langou <alangou@nvidia.com>
49 lines
1.6 KiB
Plaintext
49 lines
1.6 KiB
Plaintext
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Inputs are raw, repository-relative Trivy config reports. Consolidation is
|
|
# presentation only: the gate continues comparing unmodified reports per profile.
|
|
if length == 0 or any(.[];
|
|
.SchemaVersion != 2
|
|
or (.ArtifactName | type) != "string"
|
|
or (.ArtifactType | type) != "string"
|
|
or (.TrivyProfile | type) != "string"
|
|
or (.Results != null and (.Results | type) != "array")
|
|
) then error("invalid Trivy configuration reports") else . end
|
|
| .[0] as $template
|
|
| [
|
|
.[] as $report
|
|
| $report.Results[]?
|
|
| (.Misconfigurations[]?.TrivyProfile) = $report.TrivyProfile
|
|
] as $results
|
|
| $template
|
|
| .ArtifactName = "deployment configuration (all profiles)"
|
|
| del(.TrivyProfile)
|
|
| .Results = (
|
|
$results
|
|
| group_by([.Target, .Class, .Type])
|
|
| map(
|
|
. as $targets
|
|
| .[0]
|
|
| .Misconfigurations = (
|
|
[$targets[] | .Misconfigurations[]?]
|
|
| group_by([
|
|
.ID, .Namespace, .Severity, .Message,
|
|
.CauseMetadata.Provider, .CauseMetadata.Service,
|
|
.CauseMetadata.Resource
|
|
])
|
|
| map(
|
|
. as $findings
|
|
| .[0]
|
|
| .Message += ("\nProfiles: " + ($findings | map(.TrivyProfile) | unique | join(", ")))
|
|
| del(.TrivyProfile)
|
|
)
|
|
)
|
|
| .MisconfSummary = {
|
|
Successes: 0,
|
|
Failures: (.Misconfigurations | length),
|
|
Exceptions: 0
|
|
}
|
|
)
|
|
)
|