test: use up2562-test shiftleft dev binary (UP-2562 binary-twin FP) - #43
Open
nofar-shapir wants to merge 16 commits into
Open
test: use up2562-test shiftleft dev binary (UP-2562 binary-twin FP)#43nofar-shapir wants to merge 16 commits into
nofar-shapir wants to merge 16 commits into
Conversation
The PR comment was built only from `introducedCves` (CVEs newly introduced vs the previously-scanned image). On a re-scan where no NEW CVEs appear, the comment collapsed to "all clear ✅" even though the image still contained hundreds of CVEs — making a vulnerable PR look clean. The scan JSON already carries the full picture (`introducedCves`, `noChangeCves`, `resolvedCves`). Build the comment from the whole image (`introducedCves + noChangeCves`) and report absolute totals: Total CVEs in image: N (X new since last scan · Y already present · Z resolved) "all clear ✅" now means the image truly has 0 CVEs. Severity tables are capped at MAX_ROWS (80) per table with a "see Upwind Console" note so vulnerability-heavy images stay under GitHub's 65536-char comment limit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Multi-arch, CVE-heavy images (e.g. ubuntu:22.04 → 7 platforms) made the
comment large enough that `jq -n --arg body "$COMMENT"` exceeded the OS
single-argument limit ("Argument list too long", exit 126), and could also
blow past GitHub's 65536-char comment limit.
- Send the body via a file (`jq -Rs` + `curl --data @file`), never as a
shell argument.
- Add a COMMENT_BUDGET so detail tables stop once near the limit while every
per-arch summary (the whole-image totals) is always kept; note truncation
once. Lower MAX_ROWS to 60 and add a final hard 65000-char safety net.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Build each severity table into a local buffer and append only if it fits COMMENT_BUDGET (raised 44000->60000 now that the check is exact), so more CVEs are shown while staying under GitHub's 65536-char comment limit. The final hard cap now truncates at a newline boundary and closes any unclosed <details> tags so the comment always renders valid markdown. Clean up the payload temp file. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add optional `main_branch` (+ `pr_id`/`pr_link`) inputs. When `main_branch` is set, pass `--main-branch` (etc.) to the shiftleft binary so introduced/ resolved CVEs are computed against the latest scanned image of the base branch instead of the previous commit's image. Flags are appended only when the inputs are non-empty (via EXTRA_ARGS), so the action stays compatible with shiftleft binaries that predate the flags — default behaviour is unchanged. Depends on upwindsecurity/shiftleft#243 being merged and a new binary released before `main_branch` is actually used. Also requires the base branch to have been scanned (e.g. an on:push:[main] workflow) so a baseline exists. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…al count) Combines the main_branch wiring with a diff-focused comment: 'N newly introduced · R resolved · T total in this PR vs <base>', a severity breakdown of the total, and collapsible tables listing ONLY introduced (by severity, CVE/Package/Version/Fix) and resolved (CVE/Package/Version). Already-present CVEs are counted in the total but not listed. CVE ids link to NVD. Skips commenting when scan output is empty (backend not ready) instead of posting an unknown:unknown placeholder. Body is sent via a file to avoid OS arg-length limits; final hard cap keeps it under GitHub's 65536-char limit.
The SCA /code panel keyed by fingerprint is for the code scan; an image scan must link to the vulnerabilities Shift-left panel keyed by imageVersion.
…gerprint Confirmed against a real console URL: the scan-details deep link is /code?...secondaryTab=SCA&sidePanel=scan-at-build&sidePanelItemId=<fingerprint> (the 64-hex SBOM fingerprint), not imageVersion.
… binary) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test-only branch to validate the UP-2562 openssl binary-twin FP fix end-to-end.
Points the agent download channel at
up2562-test(built from shiftleft PR #254, branchfix/UP-2562-remove-binary-twin-fp) instead ofvsmain-test. Based ontest/full-vs-main-devbinaryso the full-vs-main diff/comment behavior is preserved.Do not merge — test harness for validating the fix via a Noble golden-image repo.
🤖 Generated with Claude Code