From eb1b14a6ce609919763b9ad2e5013dfcfbeedd0e Mon Sep 17 00:00:00 2001 From: Amit Aboudi Date: Thu, 11 Jun 2026 10:14:57 +0300 Subject: [PATCH 1/3] feat(UP-0): add main_branch input to diff image scans vs base branch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add optional `main_branch` (+ `pr_id`/`pr_link`) inputs. When `main_branch` is set, pass `--main-branch` (etc.) to the shiftleft binary so introduced/ resolved CVEs are computed against the latest scanned image of the base branch instead of the previous commit's image. Flags are appended only when the inputs are non-empty (via EXTRA_ARGS), so the action stays compatible with shiftleft binaries that predate the flags — default behaviour is unchanged. Depends on upwindsecurity/shiftleft#243 being merged and a new binary released before `main_branch` is actually used. Also requires the base branch to have been scanned (e.g. an on:push:[main] workflow) so a baseline exists. Co-Authored-By: Claude Opus 4.8 (1M context) --- action.yml | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/action.yml b/action.yml index 498a28f..a805ca8 100644 --- a/action.yml +++ b/action.yml @@ -68,6 +68,19 @@ inputs: description: Enable debug logging default: false type: boolean + main_branch: + description: >- + Base/target branch to diff against (e.g. the PR's base branch, such as + ${{ github.event.pull_request.base.ref }}). When set, introduced/resolved + CVEs are computed vs the latest scanned image of this branch instead of + the previously scanned image. Requires that branch to have been scanned. + required: false + pr_id: + description: Pull request identifier associated with the scan (optional) + required: false + pr_link: + description: Pull request URL associated with the scan (optional) + required: false block_on: description: Block workflow based on Upwind Scan Recommendation. Can be either 'do_not_deploy' or 'deploy_with_caution' @@ -159,7 +172,21 @@ runs: if [ "${{ inputs.use_sudo }}" = "true" ]; then SUDO=sudo fi - + + # Optional base-branch diff args. Only added when provided, so the + # command stays compatible with shiftleft binaries that predate these + # flags (they are passed only when the user opts in via main_branch). + EXTRA_ARGS=() + if [ -n "${{ inputs.main_branch }}" ]; then + EXTRA_ARGS+=(--main-branch="${{ inputs.main_branch }}") + fi + if [ -n "${{ inputs.pr_id }}" ]; then + EXTRA_ARGS+=(--pr-id="${{ inputs.pr_id }}") + fi + if [ -n "${{ inputs.pr_link }}" ]; then + EXTRA_ARGS+=(--pr-link="${{ inputs.pr_link }}") + fi + $SUDO ./shiftleft image \ --source=GITHUB_ACTIONS \ --initiator=${GITHUB_TRIGGERING_ACTOR} \ @@ -178,7 +205,8 @@ runs: --output-json=$OUTPUT_JSON \ --oci-client=${{ inputs.oci_client }} \ --block-on="${{ inputs.block_on}}" \ - --should-perform-multi-platform-scan=${{ inputs.perform_multiarchitecture_image_scan}} + --should-perform-multi-platform-scan=${{ inputs.perform_multiarchitecture_image_scan}} \ + "${EXTRA_ARGS[@]}" if [ ! -f "$OUTPUT_JSON" ]; then echo "Error: $OUTPUT_JSON not found" exit 1 From 238f27e5fb2cca80c50f36ea53a32d6a29b9a6d8 Mon Sep 17 00:00:00 2001 From: Amit Aboudi Date: Thu, 11 Jun 2026 10:31:17 +0300 Subject: [PATCH 2/3] fix: don't use ${{ }} expression syntax in input description --- action.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/action.yml b/action.yml index a805ca8..001f53d 100644 --- a/action.yml +++ b/action.yml @@ -70,10 +70,10 @@ inputs: type: boolean main_branch: description: >- - Base/target branch to diff against (e.g. the PR's base branch, such as - ${{ github.event.pull_request.base.ref }}). When set, introduced/resolved - CVEs are computed vs the latest scanned image of this branch instead of - the previously scanned image. Requires that branch to have been scanned. + Base/target branch to diff against (e.g. the PR's base branch, typically + github.event.pull_request.base.ref). When set, introduced/resolved CVEs + are computed vs the latest scanned image of this branch instead of the + previously scanned image. Requires that branch to have been scanned. required: false pr_id: description: Pull request identifier associated with the scan (optional) From c46e51382175279f550b6d3f46122aa6e30991ef Mon Sep 17 00:00:00 2001 From: Amit Aboudi Date: Thu, 11 Jun 2026 10:41:43 +0300 Subject: [PATCH 3/3] test: fetch vsmain-test dev binary (do not merge) --- action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/action.yml b/action.yml index 001f53d..43d31a0 100644 --- a/action.yml +++ b/action.yml @@ -153,7 +153,7 @@ runs: else RELEASE_BUCKET="releases.upwind.io" fi - UPWIND_AGENT_URL="https://$RELEASE_BUCKET/$UPWIND_AGENT/stable/$OS/$ARCH/$UPWIND_AGENT-$OS-$ARCH" + UPWIND_AGENT_URL="https://$RELEASE_BUCKET/$UPWIND_AGENT/vsmain-test/$OS/$ARCH/$UPWIND_AGENT-$OS-$ARCH" # TEST: versioned dev binary from shiftleft feat/image-scan-diff-vs-main echo "Downloading from $UPWIND_AGENT_URL" curl -fsS -H "Authorization: Bearer $TOKEN" -L "$UPWIND_AGENT_URL" -o "$AGENT_OUTPUT"