[v1.3.0] Only trigger vuln threshold on fixable vulns

[bluesentinelsec]

Context

This action permits users to perform custom logic if a vulnerability threshold is exceeded. For example, the user can specify that they wish to fail the scan if 1 or more critical vulnerabilities are present. An example of this can be seen here.

The problem is, this action does not distinguish between vulnerabilities with or without a fix when determining if the vulnerability threshold is exceeded. Users have asked that we extend this behavior to trigger the threshold-exceeded flag only if found vulnerabilities are fixable (see here).

Behavior before changes

Before this PR, the action would count all identified vulnerabilities towards the threshold exceeded flag, regardless of whether a fix was available or not.

Behavior after changes

After this PR, if the user toggles --threshold-fixable-only, then only vulnerabilities with a fix will be counted towards the threshold exceeded flag. Vulnerabilities without a fix will not count towards the threshold exceeded flag. In that way, users can decide how they want to respond to only fixable vulnerabilities, while ignoring vulns without an available fix.

User experience

Users can opt-into this feature by adding a flag to their Inspector workflows, threshold_fixable_only, shown below.

uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@version
with:
    ... other arguments ...
    threshold_fixable_only: "true"

Testing the changes

It is difficult to find a resource that only contains unfixable vulnerabilities.

Therefore, we've settled for mocking scan results to prove this feature works as intended.

Reviewers can experiment with the changes from the CLI, shown below:

# From "vulnerability-scan-github-action-for-amazon-inspector" directory
python3 entrypoint/main.py \
    --artifact-type container \
    --artifact-path /tmp/dev.tar \
    --thresholds \
    --critical 1 \
    --high 1 \
    --threshold-fixable-only \
    --show-only-fixable-vulns \
    --display-vuln-findings=enabled