Skip to content

Commit 8a46d20

Browse files
bluesentinelsecclueleafMichael LongCarolMebiomMaria Carolina Conceição
authored
Sync 1.x to branch v1.3.0 (#124)
* replace scanner example (#84) * Write CSV with no vulns (#86) * reproducing issue - test 1 * resolve issue 85 - test 2 * test 3 * test fix --------- Co-authored-by: Michael Long <mlongii@amazon.com> * testing CSV with no vulns * test against main branch * Write Dockerfile CSV and Markdown on no vulns (#88) Co-authored-by: Michael Long <mlongii@amazon.com> * Set example workflows to main branch for testing * Display 'no vulns found' for Dockerfiles (#92) Co-authored-by: Michael Long <mlongii@amazon.com> * Tweak dockerfile report (#93) Co-authored-by: Michael Long <mlongii@amazon.com> * Omit Dockerfile table on no vulns (#94) Co-authored-by: Michael Long <mlongii@amazon.com> * Updated workflows to v1.x - testing auto-updates (#96) Co-authored-by: Michael Long <mlongii@amazon.com> * update README (#97) Co-authored-by: Michael Long <mlongii@amazon.com> * Extend vulnerability severity providers (#98) * Add severity providers: GHSA, GitLab * Add severity providers: GHSA, GitLab * Add REDHAT_CVE and UBUNTU_CVE providers * rename GHSA to GITHUB --------- Co-authored-by: Michael Long <mlongii@amazon.com> * Add platform argument for container image scans (#102) * add --platform support for multi-arch containers * test multi-arch images on current branch * test actions against sbomgen 1.5.1-beta * fix --platform parsing error * fix platform parsing bug * test workflows on sbomgen latest (1.5.2) * Validate --platform input * Add more test cases, and revert workflow definitions * fix typo in platform arg --------- Co-authored-by: Michael Long <mlongii@amazon.com> * Improve severity rating consistency (#112) * fix severity rating mismatch * temporarily add a test workflow * Fix type issue: float provided, expected string * Rename workflow / job name * Add severity comparison logic * Revise severity sorting and selection logic * return default values on error * skip EPSS ratings for severity column * debugging unknown ratings * fix ratings with unknown name * Verify AMAZON_INSPECTOR renders correctly * fix failing test * temporarily disable failing tests * pass unit test: test_parse_inspector_scan_result * pass unit tests * change '-f' to '--failfast' for clarity * Remove unused type cast * refactor csv test * severity is rendered as 'other' not 'unknown' * test build on all actions * normalize dockerfile findings severity rating * debugging dockerfile severity * debugging * Normalize Dockerfile severity 'info' to 'other' * restore test actions * minor comment update * Remove develop workflow * Address PR feedback * test workflows against refactor * handle edge case CVE-2025-22871 * fix missing severity edge case * debugging epss * debugging * fix flawed test * added test case for absent severity rating * revert workflows to v1 --------- Co-authored-by: Michael Long <mlongii@amazon.com> * Feature request 91 (#115) * FR-91: Add cli arg only fixable vulnerability; use the variable in get_vuln_counts * Revert "FR-91: Add cli arg only fixable vulnerability; use the variable in get_vuln_counts" This reverts commit bc532d4. * FR-91: Add cli arg only fixable vulnerability; use the variable in get_vuln_counts * FR-91: Fix unit tests * FR-91: Fix typo in unit tests * Revert "FR-91: Fix typo in unit tests" This reverts commit e645542. * Revert "FR-91: Fix unit tests" This reverts commit f9157c9. * Revert "FR-91: Add cli arg only fixable vulnerability; use the variable in get_vuln_counts" This reverts commit 812c685. * FR-91: Change orchestrator to only find fixed vulnerabilities if flag show-only-fixed-vulnerabilities is present * FR-91: Fixed missing variable * FR-91: Fixed typo * FR-91: Fixed typo * FR-91: Another fix * FR-91: Another fix * FR-91: Another fix * FR-91: Another fix * FR-91: Another fix * FR-91: Another fix * FR-91: Another fix * Add unit test for get_vuln_count * Fix unit test for get_vuln_count --------- Co-authored-by: Maria Carolina Conceição <carolina.bento@floy.com> * Clarify license of inspector-sbomgen dependency (#121) Co-authored-by: Michael Long <mlongii@amazon.com> * [v1.3.0] Only trigger vuln threshold on fixable vulns (#122) * Add --threshold-fixable-only to CLI * implemented business logic * changed 'threshold_fixable_only' from str to bool * Added more test coverage and CLI refinements * debugging failing unit test * test threshold-fixable-only in workflow * test threshold-fixable-only in workflow * debugging CI/CD * debugging CI/CD * debugging * debugging * debugging * debugging * removed debug log showing CLI arguments * add missing argument, fixed_vuln_counts * simplify get_fixed_vuln_counts() return values * refactor return types in get_scan_result() * refactor * refine get_fixed_vuln_counts() * update test_get_fixed_vuln_counts() * testing case sensitivity * revert 'TRUE' to 'true' * use debug log when vuln doesnt have rating * integrate --show-only-fixable-vulns (part 1) * integrate only show fixable vulns * test example workflows * fix CLI input arguments * remove leading '-' character for conditional inclusion * add a no-op CLI arg (workaround) * enable new arguments in workflows * fix failing test * update workflows for prod --------- Co-authored-by: Michael Long <mlongii@amazon.com> * set workflows to v1.3.0 for burn-in --------- Co-authored-by: clueleaf <10379303+clueleaf@users.noreply.github.com> Co-authored-by: Michael Long <mlongii@amazon.com> Co-authored-by: CarolMebiom <59604360+CarolMebiom@users.noreply.github.com> Co-authored-by: Maria Carolina Conceição <carolina.bento@floy.com>
1 parent e8df48b commit 8a46d20

26 files changed

+839
-182
lines changed

‎.github/workflows/build_scan_container.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
4848

4949
- name: Scan built image with Inspector
50-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.1.3
50+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
5151
id: inspector
5252
with:
5353
artifact_type: 'container'

‎.github/workflows/example_display_findings.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
# modify this block to scan your intended artifact
3030
- name: Inspector Scan
3131
id: inspector
32-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.1.3
32+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
3333
with:
3434
# change artifact_type to either 'repository', 'container', 'binary', or 'archive'.
3535
# this example scans a container image

‎.github/workflows/example_vulnerability_threshold_exceeded.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848

4949
# Inspector scan
5050
- name: Scan container with Inspector
51-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.1.3
51+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
5252
id: inspector
5353
with:
5454
artifact_type: 'container' # configure Inspector for scanning a container

‎.github/workflows/test_archive.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232

3333
- name: Test archive scan
3434
id: inspector
35-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.1.3
35+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
3636
with:
3737
artifact_type: 'archive'
3838
artifact_path: 'entrypoint/tests/test_data/artifacts/archives/testData.zip'

‎.github/workflows/test_binary.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232

3333
- name: Test binary scan
3434
id: inspector
35-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.1.3
35+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
3636
with:
3737
artifact_type: 'binary'
3838
artifact_path: 'entrypoint/tests/test_data/artifacts/binaries/inspector-sbomgen'

‎.github/workflows/test_containers.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,13 @@ jobs:
3232

3333
- name: Test container scan
3434
id: inspector
35-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.1.3
35+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
3636
with:
3737
artifact_type: 'container'
3838
artifact_path: 'ubuntu:14.04'
39+
platform: "linux/arm64"
3940
display_vulnerability_findings: "enabled"
40-
sbomgen_version: "1.3.1"
41+
sbomgen_version: "latest"
4142

4243
- name: Display scan results
4344
run: cat ${{ steps.inspector.outputs.inspector_scan_results }}

‎.github/workflows/test_dockerfile_vulns.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131

3232
- name: Scan Dockerfiles
3333
id: inspector
34-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.1.3
34+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
3535
with:
3636
artifact_type: 'repository'
3737
artifact_path: './'

‎.github/workflows/test_installation.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
2929

3030
- name: Test Amazon Inspector GitHub Actions plugin
31-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.1.3
31+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
3232
with:
3333
artifact_type: 'container'
3434
artifact_path: 'alpine:latest'

‎.github/workflows/test_no_vulns.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828

2929
- name: Test binary scan
3030
id: inspector
31-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.1.3
31+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
3232
with:
3333
artifact_type: 'binary'
3434
artifact_path: 'entrypoint/tests/test_data/artifacts/binaries/test_go_binary'

‎.github/workflows/test_reports_no_vulns.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Test CSV no vulns
2+
3+
on:
4+
push:
5+
branches: #
6+
- '*'
7+
8+
jobs:
9+
daily_job:
10+
runs-on: ubuntu-latest
11+
environment:
12+
name: plugin-development
13+
14+
steps:
15+
16+
- name: Checkout this repository
17+
uses: actions/checkout@v4
18+
19+
- name: Configure AWS credentials
20+
uses: aws-actions/configure-aws-credentials@v4
21+
with:
22+
aws-region: ${{ secrets.AWS_REGION }}
23+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
24+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
25+
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
26+
27+
- name: Test container scan
28+
id: inspector
29+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1.3.0
30+
with:
31+
artifact_type: 'container'
32+
artifact_path: 'alpine:latest'
33+
display_vulnerability_findings: "enabled"
34+
sbomgen_version: "latest"
35+
36+
- name: Display scan results
37+
run: cat ${{ steps.inspector.outputs.inspector_scan_results_csv }}
38+
39+
- name: Display scan results (JSON)
40+
run: cat ${{ steps.inspector.outputs.inspector_scan_results }}
41+
42+
- name: Display package vulns (CSV)
43+
run: cat ${{ steps.inspector.outputs.inspector_scan_results_csv }}
44+
45+
- name: Display package vulns (MD)
46+
run: cat ${{ steps.inspector.outputs.inspector_scan_results_markdown }}
47+
48+
- name: Display Dockerfile vulns (CSV)
49+
run: cat ${{ steps.inspector.outputs.inspector_dockerfile_scan_results_csv }}
50+
51+
- name: Display Dockerfile vulns (MD)
52+
run: cat ${{ steps.inspector.outputs.inspector_dockerfile_scan_results_markdown }}

0 commit comments

Comments
 (0)