chore: clean .gitignore cache
This commit is contained in:
GitHub Actions
@@ -1,246 +0,0 @@
|
||||
# Supply Chain Security - Enhanced Vulnerability Reporting
|
||||
|
||||
## Overview
|
||||
|
||||
Enhanced the supply chain security workflow (`.github/workflows/supply-chain-verify.yml`) to provide detailed vulnerability information in PR comments, not just summary counts.
|
||||
|
||||
## Changes Implemented
|
||||
|
||||
### 1. New Vulnerability Parsing Step
|
||||
|
||||
Added `Parse Vulnerability Details` step that:
|
||||
|
||||
- Extracts detailed vulnerability data from Grype JSON output
|
||||
- Generates separate files for each severity level (Critical, High, Medium, Low)
|
||||
- Limits to first 20 vulnerabilities per severity to maintain PR comment readability
|
||||
- Captures key information:
|
||||
- CVE ID
|
||||
- Package name
|
||||
- Current version
|
||||
- Fixed version (if available)
|
||||
- Brief description (truncated to 80 characters)
|
||||
|
||||
**Implementation:**
|
||||
|
||||
```yaml
|
||||
- name: Parse Vulnerability Details
|
||||
run: |
|
||||
jq -r '
|
||||
[.matches[] | select(.vulnerability.severity == "Critical")] |
|
||||
sort_by(.vulnerability.id) |
|
||||
limit(20; .[]) |
|
||||
"| \(.vulnerability.id) | \(.artifact.name) | \(.artifact.version) | \(.vulnerability.fix.versions[0] // "No fix available") | \(.vulnerability.description[0:80] // "N/A") |"
|
||||
' vuln-scan.json > critical-vulns.txt
|
||||
```
|
||||
|
||||
### 2. Enhanced PR Comment Format
|
||||
|
||||
Updated `Build PR Comment Body` step to include:
|
||||
|
||||
#### Summary Section (Preserved)
|
||||
|
||||
- Maintains existing summary table with vulnerability counts
|
||||
- Clear status indicators (✅ No issues, ⚠️ High/Critical found)
|
||||
- Direct link to full workflow run
|
||||
|
||||
#### New Detailed Findings Section
|
||||
|
||||
- **Collapsible Details**: Uses `<details>` tags for each severity level
|
||||
- **Markdown Tables**: Formatted vulnerability lists with:
|
||||
- CVE ID
|
||||
- Package name and version
|
||||
- Fixed version
|
||||
- Brief description
|
||||
- **Severity Grouping**: Separate sections for Critical, High, Medium, and Low
|
||||
- **Truncation Handling**: Shows first 20 vulnerabilities per severity, with "...and X more" message if truncated
|
||||
|
||||
**Example Output:**
|
||||
|
||||
```markdown
|
||||
## 🔍 Detailed Findings
|
||||
|
||||
<details>
|
||||
<summary>🔴 <b>Critical Vulnerabilities (5)</b></summary>
|
||||
|
||||
| CVE | Package | Current Version | Fixed Version | Description |
|
||||
|-----|---------|----------------|---------------|-------------|
|
||||
| CVE-2025-12345 | golang.org/x/net | 1.22.0 | 1.25.5 | Buffer overflow in HTTP/2 handler |
|
||||
| CVE-2025-67890 | alpine-baselayout | 3.4.0 | 3.4.1 | Privilege escalation via /etc/passwd |
|
||||
...
|
||||
|
||||
_...and 3 more. View the full scan results for complete details._
|
||||
</details>
|
||||
```
|
||||
|
||||
### 3. Vulnerability Scan Artifacts
|
||||
|
||||
Added artifact upload for detailed analysis:
|
||||
|
||||
- **Full JSON Report**: `vuln-scan.json` with complete Grype output
|
||||
- **Parsed Tables**: Individual `.txt` files for each severity level
|
||||
- **Retention**: 30 days for historical tracking
|
||||
- **Use Cases**:
|
||||
- Deep dive analysis
|
||||
- Compliance audits
|
||||
- Trend tracking across builds
|
||||
|
||||
### 4. Edge Case Handling
|
||||
|
||||
#### No Vulnerabilities
|
||||
|
||||
- Shows celebratory message with empty table
|
||||
- No detailed findings section (clean display)
|
||||
|
||||
#### Scan Failures
|
||||
|
||||
- Existing error handling preserved
|
||||
- Shows error message with link to logs
|
||||
- Action required notification
|
||||
|
||||
#### Large Vulnerability Lists
|
||||
|
||||
- Limits display to first 20 per severity
|
||||
- Adds "...and X more" message with link to full report
|
||||
- Prevents GitHub comment size limits (65,536 characters)
|
||||
|
||||
#### Missing Data
|
||||
|
||||
- Gracefully handles missing fixed versions ("No fix available")
|
||||
- Shows "N/A" for missing descriptions
|
||||
- Fallback messages if parsing fails
|
||||
|
||||
## Benefits
|
||||
|
||||
### For Developers
|
||||
|
||||
- **Immediate Visibility**: See specific CVEs without leaving the PR
|
||||
- **Actionable Information**: Know exactly which packages need updating
|
||||
- **Prioritization**: Severity grouping helps focus on critical issues first
|
||||
- **Context**: Brief descriptions provide quick understanding
|
||||
|
||||
### For Security Reviews
|
||||
|
||||
- **Compliance**: Complete audit trail via artifacts
|
||||
- **Tracking**: Historical data for vulnerability trends
|
||||
- **Evidence**: Detailed reports for security assessments
|
||||
- **Integration**: JSON format compatible with security tools
|
||||
|
||||
### For CI/CD
|
||||
|
||||
- **Performance**: Maintains fast PR feedback (no additional scans)
|
||||
- **Readability**: Collapsible sections keep comments manageable
|
||||
- **Automation**: Structured data enables further automation
|
||||
- **Maintainability**: Clear separation of summary vs. details
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Data Flow
|
||||
|
||||
1. **Grype Scan** → Generates `vuln-scan.json` (existing)
|
||||
2. **Parse Step** → Extracts data using `jq` into `.txt` files
|
||||
3. **Comment Build** → Assembles markdown with collapsible sections
|
||||
4. **PR Update** → Posts/updates comment (existing mechanism)
|
||||
5. **Artifact Upload** → Preserves full data for analysis
|
||||
|
||||
### Performance Impact
|
||||
|
||||
- **Minimal**: Parsing adds ~5-10 seconds
|
||||
- **No Additional Scans**: Reuses existing Grype output
|
||||
- **Cached Database**: Grype DB already updated in scan step
|
||||
|
||||
### GitHub API Considerations
|
||||
|
||||
- **Comment Size**: Truncation at 20/severity keeps well below 65KB limit
|
||||
- **Rate Limits**: Single comment update (not multiple calls)
|
||||
- **Markdown Rendering**: Uses native GitHub markdown (no custom HTML)
|
||||
|
||||
## Usage Examples
|
||||
|
||||
### Developer Workflow
|
||||
|
||||
1. Submit PR
|
||||
2. Wait for docker-build to complete
|
||||
3. Review supply chain security comment
|
||||
4. Expand Critical/High sections
|
||||
5. Update dependencies based on fixed versions
|
||||
6. Push updates, workflow re-runs automatically
|
||||
|
||||
### Security Audit
|
||||
|
||||
1. Navigate to Actions → Supply Chain Verification
|
||||
2. Download `vulnerability-scan-*.zip` artifact
|
||||
3. Extract `vuln-scan.json`
|
||||
4. Import to security analysis tools (Grafana, Splunk, etc.)
|
||||
5. Generate compliance reports
|
||||
|
||||
### Troubleshooting
|
||||
|
||||
- **No details shown**: Check workflow logs for parsing errors
|
||||
- **Truncated list**: Download artifact for full list
|
||||
- **Outdated data**: Trigger manual workflow run to refresh
|
||||
- **Missing CVE info**: Some advisories lack complete metadata
|
||||
|
||||
## Future Enhancements
|
||||
|
||||
### Potential Improvements
|
||||
|
||||
- [ ] **Links to CVE Databases**: Add NIST/NVD links for each CVE
|
||||
- [ ] **CVSS Scores**: Include severity scores (numerical)
|
||||
- [ ] **Exploitability**: Flag if exploit is publicly available
|
||||
- [ ] **False Positive Suppression**: Allow marking vulnerabilities as exceptions
|
||||
- [ ] **Trend Graphs**: Show vulnerability count over time
|
||||
- [ ] **Slack/Teams Integration**: Send alerts for critical findings
|
||||
- [ ] **Auto-PR Creation**: Generate PRs for dependency updates
|
||||
- [ ] **SLA Tracking**: Monitor time-to-resolution for vulnerabilities
|
||||
|
||||
### Integration Opportunities
|
||||
|
||||
- **GitHub Security**: Link to Security tab alerts
|
||||
- **Dependabot**: Cross-reference with dependency PRs
|
||||
- **CodeQL**: Correlate with code analysis findings
|
||||
- **Container Registries**: Compare with GHCR scanning results
|
||||
|
||||
## Migration Notes
|
||||
|
||||
### Backward Compatibility
|
||||
|
||||
- ✅ Existing summary format preserved
|
||||
- ✅ Comment update mechanism unchanged
|
||||
- ✅ No breaking changes to workflow triggers
|
||||
- ✅ Artifact naming follows existing conventions
|
||||
|
||||
### Rollback Plan
|
||||
|
||||
If issues arise:
|
||||
|
||||
1. Revert the three modified steps in workflow file
|
||||
2. Existing summary-only comments will resume
|
||||
3. No data loss (artifacts still uploaded)
|
||||
4. Previous PR comments remain intact
|
||||
|
||||
## Testing Checklist
|
||||
|
||||
- [ ] Test with zero vulnerabilities (clean image)
|
||||
- [ ] Test with <20 vulnerabilities per severity
|
||||
- [ ] Test with >20 vulnerabilities (truncation)
|
||||
- [ ] Test with missing fixed versions
|
||||
- [ ] Test with scan failures
|
||||
- [ ] Test SBOM validation failures
|
||||
- [ ] Verify PR comment formatting on mobile
|
||||
- [ ] Verify artifact uploads successfully
|
||||
- [ ] Test with multiple PRs simultaneously
|
||||
- [ ] Verify comment updates correctly (not duplicates)
|
||||
|
||||
## References
|
||||
|
||||
- **Grype Documentation**: <https://github.com/anchore/grype>
|
||||
- **GitHub Actions Best Practices**: <https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions>
|
||||
- **Markdown Collapsible Sections**: <https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/organizing-information-with-collapsed-sections>
|
||||
- **OWASP Dependency Check**: <https://owasp.org/www-project-dependency-check/>
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2026-01-11
|
||||
**Author**: GitHub Copilot
|
||||
**Status**: ✅ Implemented
|
||||
**Workflow File**: `.github/workflows/supply-chain-verify.yml`
|
||||
Reference in New Issue
Block a user