Skip to content

feat: Improve grype error handling #455

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

feat: Improve grype error handling #455

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion GrypeVersion.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
exports.GRYPE_VERSION = "v0.87.0";
exports.GRYPE_VERSION = "v0.92.0";
68 changes: 50 additions & 18 deletions dist/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
/***/ 4739:
/***/ ((__unused_webpack_module, exports) => {

exports.GRYPE_VERSION = "v0.87.0";
exports.GRYPE_VERSION = "v0.92.0";


/***/ }),
Expand Down Expand Up @@ -427,7 +427,11 @@ async function runScan({
}
cmdArgs.push(source);

const { exitCode } = await runCommand(grypeCommand, cmdArgs, env);
const { stdout, stderr, exitCode } = await runCommand(
grypeCommand,
cmdArgs,
env,
);

out[outputFormat] = outputFile;
if (outputFormat === "table") {
Expand All @@ -441,27 +445,55 @@ async function runScan({

// If there is a non-zero exit status code there are a couple of potential reporting paths
if (exitCode > 0) {
if (!severityCutoff) {
// There was a non-zero exit status but it wasn't because of failing severity, this must be
// a grype problem
core.warning("grype had a non-zero exit status when running");
} else if (failBuild === true) {
core.setFailed(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
} else {
// There is a non-zero exit status code with severity cut off, although there is still a chance this is grype
// that is broken, it will most probably be a failed severity. Using warning here will make it bubble up in the
// Actions UI
core.warning(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
}
handleGrypeError(stdout, stderr, exitCode);
}

return out;
}

function handleGrypeError(stdout, stderr, exitCode) {
// There was a non-zero exit status but it wasn't because of failing severity, this must be
// a grype problem
if (!severityCutoff) {
core.error("Error running grype:");
core.error(stdout);
core.error(stderr);
core.setFailed(
`grype had a non-zero exit status (${exitCode}) when running`,
);
return;
}

// There is a non-zero exit status code with severity cut off and we know it is for a failing
// severity thanks to Grype returning exit code 2 starting with v0.92.0.
if (failBuild === true && exitCode === 2) {
core.setFailed(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
return;
}

// There is a non-zero exit status code with severity cut off, although there is still a chance this is grype
// that is broken, it will most probably be a failed severity. Using warning here will make it bubble up in the
// Actions UI
core.warning(stdout);
core.warning(stderr);
core.warning(
`grype had a non-zero exit status (${exitCode}) when running with severity cut off enabled but unable to confirm if a vulnerability was found`,
);

if (failBuild === true) {
core.setFailed(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
return;
}

core.warning(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
}

module.exports = {
run,
runScan,
Expand Down
66 changes: 49 additions & 17 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -413,7 +413,11 @@ async function runScan({
}
cmdArgs.push(source);

const { exitCode } = await runCommand(grypeCommand, cmdArgs, env);
const { stdout, stderr, exitCode } = await runCommand(
grypeCommand,
cmdArgs,
env,
);

out[outputFormat] = outputFile;
if (outputFormat === "table") {
Expand All @@ -427,27 +431,55 @@ async function runScan({

// If there is a non-zero exit status code there are a couple of potential reporting paths
if (exitCode > 0) {
if (!severityCutoff) {
// There was a non-zero exit status but it wasn't because of failing severity, this must be
// a grype problem
core.warning("grype had a non-zero exit status when running");
} else if (failBuild === true) {
core.setFailed(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
} else {
// There is a non-zero exit status code with severity cut off, although there is still a chance this is grype
// that is broken, it will most probably be a failed severity. Using warning here will make it bubble up in the
// Actions UI
core.warning(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
}
handleGrypeError(stdout, stderr, exitCode);
}

return out;
}

function handleGrypeError(stdout, stderr, exitCode) {
// There was a non-zero exit status but it wasn't because of failing severity, this must be
// a grype problem
if (!severityCutoff) {
core.error("Error running grype:");
core.error(stdout);
core.error(stderr);
core.setFailed(
`grype had a non-zero exit status (${exitCode}) when running`,
);
return;
}

// There is a non-zero exit status code with severity cut off and we know it is for a failing
// severity thanks to Grype returning exit code 2 starting with v0.92.0.
if (failBuild === true && exitCode === 2) {
core.setFailed(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
return;
}

// There is a non-zero exit status code with severity cut off, although there is still a chance this is grype
// that is broken, it will most probably be a failed severity. Using warning here will make it bubble up in the
// Actions UI
core.warning(stdout);
core.warning(stderr);
core.warning(
`grype had a non-zero exit status (${exitCode}) when running with severity cut off enabled but unable to confirm if a vulnerability was found`,
);

if (failBuild === true) {
core.setFailed(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
return;
}

core.warning(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
}

module.exports = {
run,
runScan,
Expand Down