* Add gitlab codequality template
* add unit test for gitlab codequality template
* update line endings to msdos (\r\n) from unix
* update gitlab docs for codeclimate template
* Update SARIF repot template
* Update test data sarif.golden
* Fix golangci-lint issue
* Add test cases
* Address review feedbacks
* Inline value in assert statement
* Fix location Uri format issue
* Fix errors in SARIF format
* Fix one golden file for integration tests
* Fix golden file
* Fix golden again :>
* Update sarif.tpl
* Update alpine-310.sarif.golden
* Added test and support of ASFF template
* Improve test coverage
* Fixed/Improved tests
* Removed extra space
* Added NVD score/vectors, Added logic to trim description due to file size restriction
* Included quotations around AccountID
* sarif: Tweak format for GitHub UI
Signed-off-by: Simarpreet Singh <simar@linux.com>
* sarif: Make sarif easier to use with a default template
This will help us use Trivy in places like GitHub Actions where
we cannot specify a template as input.
$ trivy image --format=sarif alpine:3.10.1
Signed-off-by: Simarpreet Singh <simar@linux.com>
* Revert "sarif: Make sarif easier to use with a default template"
This reverts commit 5b5d1c8f7d.
* .dockerignore: Add un-needed large directories
Signed-off-by: Simarpreet Singh <simar@linux.com>
* Dockerfile: Add sarif template.
This will let users run and save the output through the docker image
Example:
```
docker run --rm -it -v $(pwd):/tmp aquasec/trivy:latest image -f template --template "@contrib/sarif.tpl" --output="/tmp/sarif.test" alpine:3.10.2
```
Signed-off-by: Simarpreet Singh <simar@linux.com>
* contrib/gitlab.tpl: Add new id field
https://docs.gitlab.com/ee/user/application_security/container_scanning/#reports-json-format
vulnerabilities[].id Unique identifier of the vulnerability.
vulnerabilities[].cve (DEPRECATED - use vulnerabilities[].id instead) A fingerprint string value that represents a concrete occurrence of the vulnerability. It’s used to determine whether two vulnerability occurrences are same or different. May not be 100% accurate. This is NOT a CVE.
Signed-off-by: Manuel Rüger <manuel@rueg.eu>
* Update integration test for Gitlab
Co-authored-by: Teppei Fukuda <knqyf263@gmail.com>
