Skip to content

Add Trivy diff #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
KristianGrafana merged 8 commits into from
Mar 21, 2025
Merged

Add Trivy diff #18

KristianGrafana merged 8 commits into from
Mar 21, 2025

Conversation

@KristianGrafana
Copy link
Contributor

@KristianGrafana KristianGrafana commented Dec 10, 2024

Trivy-diff can output a delta between two scans that has happened on different branches, ideally a target and branch.

Example output:

### New vulnerabilities introduced in branch test-patch compared to main

* CVE-2014-1829, Severity: MEDIUM, Package: requests, Installed: 0.22.0, Fixed: 2.3.0
* CVE-2014-1830, Severity: MEDIUM, Package: requests, Installed: 0.22.0, Fixed: 2.3.0

@KristianGrafana
Action to create Trivy diff between branches
84566b8 
This action is able to create a Trivy diff between 2 branches (ideally base and target branch upon PR creation) and then comment the delta. 

This might help engineers from merging code that introduces vulnerabilities in dependencies.
@KristianGrafana
Add trivy-diff.js
bc8e3f8
@KristianGrafana
Add README.md
25b8373
@KristianGrafana
Rename trivy-diff.yml to action.yml
c9701bc
@KristianGrafana
exit if no vulns are detected
2d639a8
@KristianGrafana
Update README.md
4ef7929
@KristianGrafana
skip install and update in second run
95b912d
@KristianGrafana
Change to checkout action
9e8bbdd
@KristianGrafana KristianGrafana merged commit ae33040 into main Mar 21, 2025
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@SadFaceSmith SadFaceSmith SadFaceSmith approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@KristianGrafana @SadFaceSmith