Colorize severity in table output

[shanedell]

Colorize severity in table output

• Create flag "--no-color" to allow disabling the color. By default its enabled. Responds to the NO_COLOR and CLICOLOR_FORCE environment variables.
• default output behavior for the table presenter is to highlight severity in its color:
  • Critical -> Bold Red
  • High -> Red
  • Medium -> Yellow
  • Low -> Green
  • Negligible -> Blue
  • Note: Golang doesn't have all colors available. Also, doesn't seem to be able use hex codes properly.

Closes #225

Note:

When you look at https://github.com/olekukonko/tablewriter/blob/master/table_with_color.go#L63 there are only so many colors available. Through testing I couldn't take the color hex codes from https://github.com/anchore/grype-vscode/blob/main/src/ui/react-components/FindingsList.tsx#L148-L162 and make them work in Golang. So I went with the below colors based on ones available:

• Critical -> Bold Red
• High -> Red
• Medium -> Yellow
• Low -> Green
• Negligible -> Blue
• Others -> Non-colored

Open to other suggestions if anyone is able to point me to other ways of coloring the tablewriter.

[spiffcs]

Here is a quick sample output to show what this looks like in the new table output.

I think it's a great change and 👍

cc @wagoodman for a final comment. I thought we might want to inverse so --no-color is default and users could add --color to stay consistent with our current default, but after running it a couple times to test and look at the output I like the color =)

[spiffcs]

@shanedell let me try and get these conflicts updated for you

[wagoodman]

Re: --color vs --no-color: I'm a fan of including both (spf13/pflag#214 with example workaround of knative/client#346), but we don't have support for this with other options today. Do we like this option (CC @anchore/tools )?

As for the default, I feel like the default should be to show colors by default. However, what's missing is the ability to know when colors are not supported by the underlying terminal. This can be done a few different ways / heuristics, but there are some underlying libs that support this already... I'd recommend using termenv for this:

• https://github.com/muesli/termenv/blob/master/profile.go#L15-L22
• https://github.com/muesli/termenv/blob/master/termenv.go#L43

This way the functionality gracefully degrades based on what the environment supports or hints at.

[shanedell]

@spiffcs I fixed the merge conflicts but did you also want me to incorporate what @wagoodman mentions with termenv before merging? Shouldn't to much of an issue as I believe there would just need to be check if !noColor && termenv.ColorProfile() == termenv.Ascii and then sets noColor = true when that condition is true right?

[shanedell]

@spiffcs I added termenv to the PR to check if color output should be enabled by default or not

[willmurphyscode]

Should we also respect the NO_COLOR environment variable? See https://no-color.org/. (Sorry if we are and I didn't realize it; I just did a search in the diff for NO_COLOR and didn't see anything.)

[wagoodman]

actually, we're about to move to bubbletea/lipgloss which might already respond to NO_COLOR env vars. I'll try it out and post back here. In the meantime let's hold off before adding a switch for this until we have an answer.

[spiffcs]

@wagoodman it looks like bubble tea supports respecting no color:
https://github.com/charmbracelet/bubbletea/pull/221/files

Example of how it uses this:
https://github.com/charmbracelet/bubbletea/blob/c4c83ba757f891a8fbe513790b0176f9f26fc85b/examples/views/main.go#L20

https://pkg.go.dev/github.com/muesli/termenv#EnvColorProfile

[wagoodman]

@spiffcs indeed, but there is still one more case to cover. There is a related issue in syft that shows the case anchore/syft#1893 .. here's the offending line https://github.com/anchore/go-logger/blob/d65da42248673d1596c5c144a974db4a10d6af60/adapter/logrus/logger.go#L47

[spiffcs]

Added the blocked label so that we can rebase this work on top of some WIP regarding a refactor of the UI library

[wagoodman]

@shanedell I've updated the branch with the latest from main and also removed the CLI flag since this should already be determined from the underlying lipgloss lib. I still need to verify the correctness, but this at least gets the branch updated.

[wagoodman]

Here's an example of the behavior when there is no TTY on stdout, using CLICOLOR_FORCE to force showing colors anyway, and using NO_COLOR to suppress output of colors.