Fix package and risk acceptance filtering

package.json

@@ -1,6 +1,6 @@
 {
   "name": "secure-inline-scan-action",
-  "version": "6.3.1",
+  "version": "6.3.2",
   "description": "This actions performs image analysis on locally built container image and posts the result of the analysis to Sysdig Secure.",
   "main": "index.js",
   "scripts": {

src/infrastructure/github/SummaryReportPresenter.ts

@@ -1,7 +1,7 @@
 import { IReportPresenter } from "../../application/ports/IReportPresenter";
-import { FilterOptions } from "../../domain/services/filtering";
+import { FilterOptions, filterPackages } from "../../domain/services/filtering";
 import { sortPackagesByVulnSeverity } from "../../domain/services/sorting";
-import { isImageRule, isPkgRule, PolicyBundleRuleImageConfig, PolicyBundleRulePkgVuln, ScanResult, Severity } from "../../domain/scanresult";
+import { isImageRule, isPkgRule, PolicyBundleRuleImageConfig, PolicyBundleRulePkgVuln, ScanResult, Severity, Vulnerability } from "../../domain/scanresult";
 import { ISummary } from "./ISummary";
 
 const EVALUATION_RESULT_AS_EMOJI: any = {
@@ -22,20 +22,60 @@ export class SummaryReportPresenter implements IReportPresenter {
 
   async generateReport(data: ScanResult, _groupByPackage: boolean, filters?: FilterOptions) {
     this.summary.addHeading(`Scan Results for ${data.metadata.pullString}`);
+    this.addFilterInfoToSummary(filters);
 
     this.addVulnTableToSummary(data, filters);
-    this.addVulnsByLayerTableToSummary(data, filters?.minSeverity || Severity.Unknown);
-    this.addReportToSummary(data);
+    this.addVulnsByLayerTableToSummary(data, filters);
+    this.addPolicyReportToSummary(data);
+  }
+
+
+  private addFilterInfoToSummary(filters?: FilterOptions) {
+    if (!filters) return;
+
+    let filterMessages: string[] = [];
+
+    if (filters.minSeverity) {
+      filterMessages.push(`Severity level: ${filters.minSeverity.toString()}`);
+    }
+
+    if (filters.packageTypes && filters.packageTypes.length > 0) {
+      filterMessages.push(`Package types included: ${filters.packageTypes.join(',')}`);
+    }
+
+    if (filters.notPackageTypes && filters.notPackageTypes.length > 0) {
+      filterMessages.push(`Package types excluded: ${filters.notPackageTypes.join(',')}`);
+    }
+
+    if (filters.excludeAccepted !== undefined && filters.excludeAccepted != false) {
+      filterMessages.push(`Exclude vulnerabilities with accepted risks`);
+    }
+
+    if (filterMessages.length > 0) {
+      this.summary.addHeading("Active Filters", 3);
+      this.summary.addList(filterMessages);
+    }
   }
 
 
   private addVulnTableToSummary(
     data: ScanResult,
     filters?: FilterOptions
   ) {
+    const packages = data.getPackages();
+    const filteredPackages = filterPackages(packages, filters);
+
+    const allVulnerabilities: Vulnerability[] = [];
+    filteredPackages.forEach(p => {
+      p.getVulnerabilities().forEach(v => {
+        allVulnerabilities.push(v);
+      });
+    });
+
     const minSeverity = filters?.minSeverity ?? Severity.Unknown;
-    const vulns = data.getVulnerabilities()
-      .filter(v => v.severity.isMoreSevereThanOrEqualTo(minSeverity));
+    const vulns = allVulnerabilities
+      .filter(v => v.severity.isMoreSevereThanOrEqualTo(minSeverity))
+      .filter(v => !filters?.excludeAccepted || v.getAcceptedRisks().length === 0);
 
     let colsToDisplay = SummaryReportPresenter.severities.filter(s => s.sev.isMoreSevereThanOrEqualTo(minSeverity));
 
@@ -59,16 +99,21 @@ export class SummaryReportPresenter implements IReportPresenter {
 
 
 
-  private addVulnsByLayerTableToSummary(data: ScanResult, minSeverity: Severity) {
+  private addVulnsByLayerTableToSummary(data: ScanResult, filters?: FilterOptions) {
+    const minSeverity = filters?.minSeverity ?? Severity.Unknown;
+
     this.summary.addHeading(`Package vulnerabilities per layer`, 2);
     const orderedLayers = data.getLayers().sort((a, b) => a.index - b.index);
 
     orderedLayers.forEach(layer => {
-      const vulnerablePackages = layer
-        .getPackages()
+      const layerPackages = layer.getPackages();
+      const filteredLayerPackages = filterPackages(layerPackages, filters);
+
+      const vulnerablePackages = filteredLayerPackages
         .filter(p => p
           .getVulnerabilities()
           .filter(v => v.severity.isMoreSevereThanOrEqualTo(minSeverity))
+          .filter(v => !filters?.excludeAccepted || v.getAcceptedRisks().length === 0)
           .length > 0
         );
 
@@ -79,7 +124,8 @@ export class SummaryReportPresenter implements IReportPresenter {
 
 
       const packageRows = vulnerablePackagesSortedBySeverity.map(pkg => {
-        const vulns = pkg.getVulnerabilities();
+        const vulns = pkg.getVulnerabilities()
+          .filter(v => !filters?.excludeAccepted || v.getAcceptedRisks().length === 0);
         const countBySeverity = (sev: Severity) => vulns.filter(v => v.severity === sev).length;
 
 
@@ -114,7 +160,7 @@ export class SummaryReportPresenter implements IReportPresenter {
     });
   }
 
-  private addReportToSummary(data: ScanResult) {
+  private addPolicyReportToSummary(data: ScanResult) {
     let policies = data.getPolicies();
     if (policies.length == 0) {
       return

src/infrastructure/sysdig/JsonScanResultV1ToScanResultAdapter.ts

@@ -114,26 +114,26 @@ export class JsonScanResultV1ToScanResultAdapter {
         layer
       );
 
+      // Add package-level accepted risks
+      if ((pkgData as any).riskAcceptRefs) {
+        for (const riskRef of (pkgData as any).riskAcceptRefs) {
+          const riskData = reportResult.riskAccepts?.[riskRef];
+          if (riskData) {
+            const risk = scanResult.findAcceptedRiskById(riskData.id);
+            if (risk) {
+              pkg.addAcceptedRisk(risk);
+            }
+          }
+        }
+      }
+
       if (pkgData.vulnerabilitiesRefs) {
         for (const vulnRef of pkgData.vulnerabilitiesRefs) {
           const jsonVuln = reportResult.vulnerabilities[vulnRef] as JsonVulnerability;
           if (jsonVuln) {
             const vulnerability = scanResult.findVulnerabilityByCve(jsonVuln.name);
             if (vulnerability) {
               pkg.addVulnerability(vulnerability);
-
-              // Replicate indirect risk association from Rust code
-              if (jsonVuln?.riskAcceptRefs) {
-                for (const riskRef of jsonVuln.riskAcceptRefs) {
-                  const riskData = reportResult.riskAccepts?.[riskRef];
-                  if (riskData) {
-                    const risk = scanResult.findAcceptedRiskById(riskData.id);
-                    if (risk) {
-                      pkg.addAcceptedRisk(risk);
-                    }
-                  }
-                }
-              }
             }
           }
         }