feat(UP-0): diff-vs-main PR comment (introduced/resolved + total, vs base branch) - #40
Open
amitaboudi wants to merge 14 commits into
Open
feat(UP-0): diff-vs-main PR comment (introduced/resolved + total, vs base branch)#40amitaboudi wants to merge 14 commits into
amitaboudi wants to merge 14 commits into
Conversation
The PR comment was built only from `introducedCves` (CVEs newly introduced vs the previously-scanned image). On a re-scan where no NEW CVEs appear, the comment collapsed to "all clear ✅" even though the image still contained hundreds of CVEs — making a vulnerable PR look clean. The scan JSON already carries the full picture (`introducedCves`, `noChangeCves`, `resolvedCves`). Build the comment from the whole image (`introducedCves + noChangeCves`) and report absolute totals: Total CVEs in image: N (X new since last scan · Y already present · Z resolved) "all clear ✅" now means the image truly has 0 CVEs. Severity tables are capped at MAX_ROWS (80) per table with a "see Upwind Console" note so vulnerability-heavy images stay under GitHub's 65536-char comment limit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Multi-arch, CVE-heavy images (e.g. ubuntu:22.04 → 7 platforms) made the
comment large enough that `jq -n --arg body "$COMMENT"` exceeded the OS
single-argument limit ("Argument list too long", exit 126), and could also
blow past GitHub's 65536-char comment limit.
- Send the body via a file (`jq -Rs` + `curl --data @file`), never as a
shell argument.
- Add a COMMENT_BUDGET so detail tables stop once near the limit while every
per-arch summary (the whole-image totals) is always kept; note truncation
once. Lower MAX_ROWS to 60 and add a final hard 65000-char safety net.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Build each severity table into a local buffer and append only if it fits COMMENT_BUDGET (raised 44000->60000 now that the check is exact), so more CVEs are shown while staying under GitHub's 65536-char comment limit. The final hard cap now truncates at a newline boundary and closes any unclosed <details> tags so the comment always renders valid markdown. Clean up the payload temp file. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add optional `main_branch` (+ `pr_id`/`pr_link`) inputs. When `main_branch` is set, pass `--main-branch` (etc.) to the shiftleft binary so introduced/ resolved CVEs are computed against the latest scanned image of the base branch instead of the previous commit's image. Flags are appended only when the inputs are non-empty (via EXTRA_ARGS), so the action stays compatible with shiftleft binaries that predate the flags — default behaviour is unchanged. Depends on upwindsecurity/shiftleft#243 being merged and a new binary released before `main_branch` is actually used. Also requires the base branch to have been scanned (e.g. an on:push:[main] workflow) so a baseline exists. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…al count) Combines the main_branch wiring with a diff-focused comment: 'N newly introduced · R resolved · T total in this PR vs <base>', a severity breakdown of the total, and collapsible tables listing ONLY introduced (by severity, CVE/Package/Version/Fix) and resolved (CVE/Package/Version). Already-present CVEs are counted in the total but not listed. CVE ids link to NVD. Skips commenting when scan output is empty (backend not ready) instead of posting an unknown:unknown placeholder. Body is sent via a file to avoid OS arg-length limits; final hard cap keeps it under GitHub's 65536-char limit.
The SCA /code panel keyed by fingerprint is for the code scan; an image scan must link to the vulnerabilities Shift-left panel keyed by imageVersion.
…gerprint Confirmed against a real console URL: the scan-details deep link is /code?...secondaryTab=SCA&sidePanel=scan-at-build&sidePanelItemId=<fingerprint> (the 64-hex SBOM fingerprint), not imageVersion.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Produces the diff-focused PR comment:
What it does
main_branch(+ optionalpr_id/pr_link) inputs and passes--main-branchso the backend diffs the image against the base branch's latest scanned image.unknown:unknown.Supersedes
This replaces/combines the earlier #37 (full-image renderer) and #38 (main_branch wiring) — both can be closed in favor of this single PR.
Depends on
upwindsecurity/shiftleft#243(adds--main-branchand forwardsRepositoryScanDetailsfor image scans). Merge + release a newstablebinary before consumers setmain_branch. Flags are passed only when the inputs are set, so this PR is safe to merge ahead of the release (no-op until used). Base branch must be scanned (e.g.on: push: [main]) so a baseline exists.🤖 Generated with Claude Code