Skip to content

feat: basic tests and doc changes for no-scan mode #5138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 10 commits into
base: main
Choose a base branch
from
13 changes: 13 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ For more details, see our [documentation](https://cve-bin-tool.readthedocs.io/en
- [Generating a VEX](#generating-a-vex)
- [Triaging vulnerabilities](#triaging-vulnerabilities)
- [Using the tool offline](#using-the-tool-offline)
- [No Scan Mode](#no-scan-mode)
- [Using CVE Binary Tool in GitHub Actions](#using-cve-binary-tool-in-github-actions)
- [Output Options](#output-options)
- [Configuration](#configuration)
Expand Down Expand Up @@ -155,6 +156,18 @@ Specifying the `--offline` option when running a scan ensures that cve-bin-tool

Note that you will need to obtain a copy of the vulnerability data before the tool can run in offline mode. [The offline how-to guide contains more information on how to set up your database.](https://github.com/intel/cve-bin-tool/blob/main/doc/how_to_guides/offline.md)

### No-Scan Mode

The No-Scan Mode is currently under development, but you can try out a beta version by running:

```bash
cve-bin-tool <directory> --no-scan
```

In this beta release, all the database-related checks are skipped. For the binary checker pipeline, it gives output based on the CPE information embedded in the checkers. For the language parser pipeline, all database queries are skipped and it returns a bunch of ScanInfo objects.

Please not that you might still find some errors while running no-scan mode in the output pipeline as it is still under development.

### Using CVE Binary Tool in GitHub Actions

If you want to integrate cve-bin-tool as a part of your github action pipeline, you can use cve-bin-tool's official GitHub Action. Find more details [here](https://github.com/intel/cve-bin-tool-action/#cve-binary-tool-github-action). The GitHub Action provide reports on the security tab, which is available to open source projects as well as GitHub customers who have paid for that access.
Expand Down
48 changes: 48 additions & 0 deletions test/test_no_scan.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
# Copyright (C) 2025 Intel Corporation
# SPDX-License-Identifier: GPL-3.0-or-later

import subprocess


def test_no_scan_exists():
"""
Test that --no-scan mode exists
"""
result = subprocess.run(
["python3", "cve_bin_tool/cli.py", "--help"],
capture_output=True,
text=True,
)

output = result.stdout + result.stderr

assert "no-scan" in output

assert result.returncode == 0


# @pytest.mark.skip(reason="Failing due to unknown errors")
def test_no_scan_output():
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems like this particular test is failing.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, Initially I tried cve-bin-tool <directory> --no-scan but that failed
Then I changed the entry point to cve_bin_tool/cli.py but that seems to fail too

Surprising how --no-scan shows up in python3 cve_bin_tool/cli.py --help but not in the above

"""
Test the tool with --no-scan flag
"""
result = subprocess.run(
["python3", "cve_bin_tool/cli.py", "./experiments", "--no-scan"],
capture_output=True,
text=True,
)

assert "No Scan Mode: No CVE Scanning" in result.stdout


def test_normal_scan():
"""
Test Normal Scan without --no-scan flag
"""
result = subprocess.run(
["python3", "cve_bin_tool/cli.py", "./experiments"],
capture_output=True,
text=True,
)

assert "No Scan Mode: No CVE Scanning" not in result.stdout
Loading