diff --git a/README.md b/README.md index 0ad3fc4..1d27528 100644 --- a/README.md +++ b/README.md @@ -31,42 +31,48 @@ the Pull Request Conversation: ### `github_token` -**Required**. Must be in form of `github_token: ${{ secrets.github_token }}`. +**Required**. + +The default is `${{ github.token }}`. ### `trivy_command` -**Required**. Trivy command [`aws`, `config`, `filesystem`, `image`, `kubernetes`, `rootfs`, `sbom`, `vm`]. +**Required**. Trivy command [`aws`, `config`, `filesystem`, `image`, `kubernetes`, `rootfs`, `sbom`, `vm`]. You can see this with `trivy --help` ### `trivy_target` **Required**. Target to scan. -It's depends on the command. Please check [Trivy Docs](https://aquasecurity.github.io/trivy/latest/docs/) +Varies depending on the `trivy_command` chosen. Please check [Trivy Docs](https://aquasecurity.github.io/trivy/latest/docs/) ### `working_directory` Optional. Directory to run the action on, from the repo root. -The default is `.` ( root of the repository). + +The default is `.` (root of the repository). ### `level` -Optional. Report level for reviewdog [`info`,`warning`,`error`]. +Optional. Report level for reviewdog [`info`, `warning`, `error`]. It's same as `-level` flag of reviewdog. + The default is `error`. ### `tool_name` Optional. Name of the tool being used. This controls how it will show up in the GitHub UI. + The default is `trivy`. ### `reporter` -Optional. Reporter of reviewdog command [`github-pr-check`,`github-pr-review`]. +Optional. Reporter of reviewdog command [`github-pr-check`, `github-pr-review`]. + The default is `github-pr-check`. ### `filter_mode` -Optional. Filtering for the reviewdog command [`added`,`diff_context`,`file`,`nofilter`]. +Optional. Filtering for the reviewdog command [`added`, `diff_context`, `file`, `nofilter`]. The default is `added`. @@ -74,7 +80,7 @@ See [reviewdog documentation for filter mode](https://github.com/reviewdog/revie ### `fail_on_error` -Optional. Exit code for reviewdog when errors are found [`true`,`false`]. +Optional. Exit code for reviewdog when errors are found [`true`, `false`]. The default is `false`. @@ -83,17 +89,19 @@ See [reviewdog documentation for exit codes](https://github.com/reviewdog/review ### `flags` Optional. Additional reviewdog flags. Useful for debugging errors, when it can be set to `-tee`. + The default is ``. ### `trivy_version` Optional. The version of trivy to install. + The default is `latest`. ### `trivy_flags` Optional. List of arguments to send to trivy. -For the output to be parsable by reviewdog [`--format=checkstyle` is enforced](./entrypoint.sh). + The default is ``. ## Outputs diff --git a/script.sh b/script.sh index 31d118c..416ae90 100755 --- a/script.sh +++ b/script.sh @@ -102,9 +102,8 @@ echo '::group:: Running trivy with reviewdog 🐶 ...' set +Eeuo pipefail # shellcheck disable=SC2086 - "${TRIVY_PATH}/trivy" --format json ${INPUT_TRIVY_FLAGS:-} --exit-code 1 ${INPUT_TRIVY_COMMAND} ${INPUT_TRIVY_TARGET} 2> /dev/null \ - | jq -r -f "${GITHUB_ACTION_PATH}/to-rdjson.jq" \ - | "${REVIEWDOG_PATH}/reviewdog" -f=rdjson \ + "${TRIVY_PATH}/trivy" --format sarif ${INPUT_TRIVY_FLAGS:-} --exit-code 1 ${INPUT_TRIVY_COMMAND} ${INPUT_TRIVY_TARGET} 2> /dev/null \ + | "${REVIEWDOG_PATH}/reviewdog" -f=sarif \ -name="${INPUT_TOOL_NAME}" \ -reporter="${INPUT_REPORTER}" \ -level="${INPUT_LEVEL}" \ @@ -112,7 +111,7 @@ echo '::group:: Running trivy with reviewdog 🐶 ...' -filter-mode="${INPUT_FILTER_MODE}" \ ${INPUT_FLAGS} - trivy_return="${PIPESTATUS[0]}" reviewdog_return="${PIPESTATUS[2]}" exit_code=$? + trivy_return="${PIPESTATUS[0]}" reviewdog_return="${PIPESTATUS[1]}" exit_code=$? echo "trivy-return-code=${trivy_return}" >> "$GITHUB_OUTPUT" echo "reviewdog-return-code=${reviewdog_return}" >> "$GITHUB_OUTPUT" echo '::endgroup::' diff --git a/to-rdjson.jq b/to-rdjson.jq deleted file mode 100644 index bf54e4b..0000000 --- a/to-rdjson.jq +++ /dev/null @@ -1,42 +0,0 @@ -# Convert trivy JSON output to Reviewdog Diagnostic Format (rdjson) -# https://github.com/reviewdog/reviewdog/blob/f577bd4b56e5973796eb375b4205e89bce214bd9/proto/rdf/reviewdog.proto -{ - source: { - name: "trivy", - url: "https://github.com/aquasecurity/trivy" - }, - diagnostics: [(.Results[]? - | .Target as $target - | .Misconfigurations[]? - | .Title as $title | .ID as $id | .PrimaryURL as $primaryURL | .Severity as $severity - | .CauseMetadata | { - message: $title, - code: { - value: $id, - url: $primaryURL, - } , - location: { - path: $target, - range: { - start: { - line: .StartLine, - }, - # Not in for tfsec - #end: { - # line: .EndLine, - #}, - } - }, - severity: (if $severity | startswith("CRITICAL") then - "ERROR" - elif $severity | startswith("HIGH") then - "ERROR" - elif $severity | startswith("MEDIUM") then - "WARNING" - elif $severity | startswith("LOW") then - "INFO" - else - null - end), - })] -}