Spaces:
Running
Running
File size: 1,471 Bytes
e70c280 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 | #!/usr/bin/env python3
"""Summarize an exact image's Trivy scan, digest, and SBOM for release gates."""
from __future__ import annotations
import argparse
import json
import subprocess
from pathlib import Path
def main() -> int:
parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("--trivy", type=Path, required=True)
parser.add_argument("--sbom", type=Path, required=True)
parser.add_argument("--image", required=True)
parser.add_argument("--output", type=Path, required=True)
args = parser.parse_args()
scan = json.loads(args.trivy.read_text(encoding="utf-8"))
counts = {"HIGH": 0, "CRITICAL": 0}
for result in scan.get("Results") or []:
for vulnerability in result.get("Vulnerabilities") or []:
severity = str(vulnerability.get("Severity", "")).upper()
if severity in counts:
counts[severity] += 1
digest = subprocess.run(
["docker", "image", "inspect", args.image, "--format", "{{.Id}}"],
check=True,
capture_output=True,
text=True,
).stdout.strip()
result = {
"high": counts["HIGH"],
"critical": counts["CRITICAL"],
"image_digest": digest,
"sbom": args.sbom.name,
}
args.output.parent.mkdir(parents=True, exist_ok=True)
args.output.write_text(json.dumps(result, indent=2, sort_keys=True) + "\n")
return 0
if __name__ == "__main__":
raise SystemExit(main())
|