@@ -103,58 +103,62 @@ trivy_tmp_dir="$(mktemp -d -p "$PROJECT_ROOT")"
103103
104104trap ' rm -rf "$tmp_dir" "$trivy_tmp_dir"'
105105
106+ PREFIXES=(" example" " enterprise"
107+
106108for image in " ${IMAGES[@]} " ; do
107- image_ref=" codercom/enterprise-${image} :${TAG} "
108- image_name=" ${image} -${TAG} "
109- output=" ${tmp_dir} /${image} -${TAG} .sarif"
110-
111- if ! docker image inspect " $image_ref " > /dev/null 2>&1 ; then
112- echo " Image '$image_ref ' does not exist locally; skipping" >&2
113- continue
114- fi
115-
116- old_tmpdir=" ${TMPDIR:- } "
117- export TMPDIR=" $trivy_tmp_dir "
118-
119- # The timeout is set to 15 minutes because in Java images it can take a while
120- # to scan JAR files for vulnerabilities.
121- run_trace $DRY_RUN trivy image \
122- --severity CRITICAL,HIGH \
123- --format sarif \
124- --output " $output "
125- --timeout 15m0s \
126- " $image_ref " 2>&1 | indent
127-
128- if [ " $old_tmpdir " = " " ; then
129- unset TMPDIR
130- else
131- export TMPDIR=" $old_tmpdir "
132- fi
133-
134- if [ $DRY_RUN = true ]; then
135- continue
136- fi
137-
138- if [ ! -f " $output " ; then
139- echo " No SARIF output found for image '$image_ref ' at '$output '" >&2
140- exit 1
141- fi
142-
143- # Do substitutions to add extra details to every message. Without these
144- # substitutions, most messages won't have any information about which image
145- # the vulnerability was found in.
146- jq \
147- " .runs[].tool.driver.name |= \" Trivy ${image_name} \" "
148- " $output " > " $output .tmp"
149- mv " $output .tmp" " $output "
150- jq \
151- " .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= \" ${image_name} /\" + ."
152- " $output " > " $output .tmp"
153- mv " $output .tmp" " $output "
154- jq \
155- " .runs[].results[].locations[].message.text |= \" ${image_name} : \" + ."
156- " $output " > " $output .tmp"
157- mv " $output .tmp" " $output "
109+ for prefix in " ${PREFIXES[@]} " ; do
110+ image_ref=" codercom/${prefix} -${image} :${TAG} "
111+ image_name=" ${prefix} -${image} -${TAG} "
112+ output=" ${tmp_dir} /${prefix} -${image} -${TAG} .sarif"
113+
114+ if ! docker image inspect " $image_ref " > /dev/null 2>&1 ; then
115+ echo " Image '$image_ref ' does not exist locally; skipping" >&2
116+ continue
117+ fi
118+
119+ old_tmpdir=" ${TMPDIR:- } "
120+ export TMPDIR=" $trivy_tmp_dir "
121+
122+ # The timeout is set to 15 minutes because in Java images it can take a while
123+ # to scan JAR files for vulnerabilities.
124+ run_trace $DRY_RUN trivy image \
125+ --severity CRITICAL,HIGH \
126+ --format sarif \
127+ --output " $output "
128+ --timeout 15m0s \
129+ " $image_ref " 2>&1 | indent
130+
131+ if [ " $old_tmpdir " = " " ; then
132+ unset TMPDIR
133+ else
134+ export TMPDIR=" $old_tmpdir "
135+ fi
136+
137+ if [ $DRY_RUN = true ]; then
138+ continue
139+ fi
140+
141+ if [ ! -f " $output " ; then
142+ echo " No SARIF output found for image '$image_ref ' at '$output '" >&2
143+ exit 1
144+ fi
145+
146+ # Do substitutions to add extra details to every message. Without these
147+ # substitutions, most messages won't have any information about which image
148+ # the vulnerability was found in.
149+ jq \
150+ " .runs[].tool.driver.name |= \" Trivy ${image_name} \" "
151+ " $output " > " $output .tmp"
152+ mv " $output .tmp" " $output "
153+ jq \
154+ " .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= \" ${image_name} /\" + ."
155+ " $output " > " $output .tmp"
156+ mv " $output .tmp" " $output "
157+ jq \
158+ " .runs[].results[].locations[].message.text |= \" ${image_name} : \" + ."
159+ " $output " > " $output .tmp"
160+ mv " $output .tmp" " $output "
161+ done
158162done
159163
160164# Merge all SARIF files into one.
0 commit comments