feat: Run trivy container scan #192
Conversation
Codacy's Analysis Summary3 new issues, 2 flagged as potential false positives (≤ 1 medium issue) Review Pull Request in Codacy →
|
There was a problem hiding this comment.
Pull request overview
This PR adds a new container-scan command to the Codacy CLI that enables vulnerability scanning of container images using Trivy. The command supports scanning single or multiple container images for vulnerabilities with configurable severity levels and package types.
Changes:
- Added new
container-scancommand with support for multiple image scanning, customizable severity levels, package types, and unfixed vulnerability filtering - Updated validation logic to skip
codacy.yamlrequirement for container-scan command - Integrated Trivy as the vulnerability scanning engine with proper input validation to prevent command injection
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| cmd/container_scan.go | Implements the new container-scan command with Trivy integration, input validation, and multi-image scanning support |
| cmd/container_scan_test.go | Provides unit tests for command arguments, flag defaults, image name validation, and Trivy argument construction |
| cmd/validation.go | Adds container-scan to the list of commands that skip codacy.yaml validation |
| cli-v2.go | Updates early-exit logic to allow container-scan to run without configuration file |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
franciscoovazevedo
force-pushed
the
run-trivy-container-scan
branch
from
851f9a2 to
9539333
Compare
Coverage summary from CodacySee diff coverage on Codacy
Coverage variation details
Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: Diff coverage details
Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: See your quality gate settings Change summary preferences |
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| func TestBuildTrivyArgs(t *testing.T) { | ||
| for _, tt := range trivyArgsTestCases { | ||
| t.Run(tt.name, func(t *testing.T) { |
There was a problem hiding this comment.
Tests are modifying global flag variables (severityFlag, pkgTypesFlag, ignoreUnfixedFlag) which can cause test interference if tests run in parallel or in different orders. This is a test isolation issue that could lead to flaky tests. Consider one of these approaches:
- Use table-driven tests with a setup/teardown that resets flags between test cases
- Store original values and restore them with t.Cleanup()
- Refactor buildTrivyArgs to accept parameters instead of reading from global variables
| t.Run(tt.name, func(t *testing.T) { | |
| t.Run(tt.name, func(t *testing.T) { | |
| // Preserve original global flag values and restore them after the subtest. | |
| origSeverity := severityFlag | |
| origPkgTypes := pkgTypesFlag | |
| origIgnoreUnfixed := ignoreUnfixedFlag | |
| t.Cleanup(func() { | |
| severityFlag = origSeverity | |
| pkgTypesFlag = origPkgTypes | |
| ignoreUnfixedFlag = origIgnoreUnfixed | |
| }) |
| func init() { | ||
| containerScanCmd.Flags().StringVar(&severityFlag, "severity", "", "Comma-separated list of severities to scan for (default: HIGH,CRITICAL)") | ||
| containerScanCmd.Flags().StringVar(&pkgTypesFlag, "pkg-types", "", "Comma-separated list of package types to scan (default: os)") | ||
| containerScanCmd.Flags().BoolVar(&ignoreUnfixedFlag, "ignore-unfixed", true, "Ignore unfixed vulnerabilities") | ||
| rootCmd.AddCommand(containerScanCmd) | ||
| } |
There was a problem hiding this comment.
The command definition places the init() function before the command variable definition, which is inconsistent with the codebase convention. Looking at other commands in the codebase (version.go:12-38, update.go:13-66, init.go:23-72), the standard pattern is to define the command variable first, then the init() function. This improves readability and follows Go conventions where init() functions typically appear at the end of the file.
No description provided.