mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-01-25 02:08:11 +00:00
103 lines
4.1 KiB
JavaScript
103 lines
4.1 KiB
JavaScript
const fs = require('fs');
|
||
|
||
// Configuration from environment variables
|
||
const REPORT_FILE = process.env.TRIVY_REPORT_FILE || 'trivy-report.json';
|
||
const IMAGE_NAME = process.env.IMAGE_NAME || 'container-image';
|
||
const GITHUB_SHA = process.env.GITHUB_SHA || 'unknown';
|
||
const GITHUB_REPOSITORY = process.env.GITHUB_REPOSITORY || '';
|
||
const GITHUB_RUN_ID = process.env.GITHUB_RUN_ID || '';
|
||
const SEVERITY = process.env.SEVERITY || 'CRITICAL,HIGH,MEDIUM,LOW';
|
||
|
||
// Parse severities to scan
|
||
const scannedSeverities = SEVERITY.split(',').map(s => s.trim());
|
||
|
||
// Read and parse the Trivy report
|
||
const report = JSON.parse(fs.readFileSync(REPORT_FILE, 'utf-8'));
|
||
|
||
let vulnCount = 0;
|
||
let vulnsByType = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
|
||
let affectedPackages = new Set();
|
||
|
||
if (report.Results && Array.isArray(report.Results)) {
|
||
for (const result of report.Results) {
|
||
if (result.Vulnerabilities && Array.isArray(result.Vulnerabilities)) {
|
||
for (const vuln of result.Vulnerabilities) {
|
||
vulnCount++;
|
||
if (vulnsByType[vuln.Severity] !== undefined) {
|
||
vulnsByType[vuln.Severity]++;
|
||
}
|
||
if (vuln.PkgName) {
|
||
affectedPackages.add(vuln.PkgName);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
const shortSha = GITHUB_SHA.substring(0, 7);
|
||
const timestamp = new Date().toISOString().replace('T', ' ').substring(0, 19) + ' UTC';
|
||
|
||
// Severity icons and labels
|
||
const severityConfig = {
|
||
CRITICAL: { icon: '🔴', label: 'Critical' },
|
||
HIGH: { icon: '🟠', label: 'High' },
|
||
MEDIUM: { icon: '🟡', label: 'Medium' },
|
||
LOW: { icon: '🔵', label: 'Low' }
|
||
};
|
||
|
||
let comment = '## 🔒 Container Security Scan\n\n';
|
||
comment += `**Image:** \`${IMAGE_NAME}:${shortSha}\`\n`;
|
||
comment += `**Last scan:** ${timestamp}\n\n`;
|
||
|
||
if (vulnCount === 0) {
|
||
comment += '### ✅ No Vulnerabilities Detected\n\n';
|
||
comment += 'The container image passed all security checks. No known CVEs were found.\n';
|
||
} else {
|
||
comment += '### 📊 Vulnerability Summary\n\n';
|
||
comment += '| Severity | Count |\n';
|
||
comment += '|----------|-------|\n';
|
||
|
||
// Only show severities that were scanned
|
||
for (const severity of scannedSeverities) {
|
||
const config = severityConfig[severity];
|
||
const count = vulnsByType[severity] || 0;
|
||
const isBold = (severity === 'CRITICAL' || severity === 'HIGH') && count > 0;
|
||
const countDisplay = isBold ? `**${count}**` : count;
|
||
comment += `| ${config.icon} ${config.label} | ${countDisplay} |\n`;
|
||
}
|
||
|
||
comment += `| **Total** | **${vulnCount}** |\n\n`;
|
||
|
||
if (affectedPackages.size > 0) {
|
||
comment += `**${affectedPackages.size}** package(s) affected\n\n`;
|
||
}
|
||
|
||
if (vulnsByType.CRITICAL > 0) {
|
||
comment += '### ⚠️ Action Required\n\n';
|
||
comment += '**Critical severity vulnerabilities detected.** These should be addressed before merging:\n';
|
||
comment += '- Review the detailed scan results\n';
|
||
comment += '- Update affected packages to patched versions\n';
|
||
comment += '- Consider using a different base image if updates are unavailable\n\n';
|
||
} else if (vulnsByType.HIGH > 0) {
|
||
comment += '### ⚠️ Attention Needed\n\n';
|
||
comment += '**High severity vulnerabilities found.** Please review and plan remediation:\n';
|
||
comment += '- Assess the risk and exploitability\n';
|
||
comment += '- Prioritize updates in the next maintenance cycle\n\n';
|
||
} else {
|
||
comment += '### ℹ️ Review Recommended\n\n';
|
||
comment += 'Medium/Low severity vulnerabilities found. Consider addressing during regular maintenance.\n\n';
|
||
}
|
||
}
|
||
|
||
comment += '---\n';
|
||
comment += '📋 **Resources:**\n';
|
||
|
||
if (GITHUB_REPOSITORY && GITHUB_RUN_ID) {
|
||
comment += `- [Download full report](https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) (see artifacts)\n`;
|
||
}
|
||
|
||
comment += '- [View in Security tab](https://github.com/' + (GITHUB_REPOSITORY || 'repository') + '/security/code-scanning)\n';
|
||
comment += '- Scanned with [Trivy](https://github.com/aquasecurity/trivy)\n';
|
||
|
||
module.exports = comment;
|