Add a Markdown format template

[ohmer]

Hi there,

Not exactly a feature request, more of an humble proposal to include a new report formatter.

I am using Trivy in GitHub Actions to scan container images. I wanted to make report easy to read in the context of a PR check. SARIF looked like great way to get there but I do not have Advanced Security. So I created a report template that generates Markdown compatible HTML to reach my goal. Maybe it could be useful to the community hence this proposal.

Here is how it looks like when added to a job summary:

Note that the CVE link is automatically generated by GitHub which leads to similar references as in the report.

Example of usage:

  trivy:
    name: Trivy scan
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v3
      - uses: actions/download-artifact@v3
        with:
          name: build
          path: .
      - run: mkdir oci && tar -C oci -xf ${{ github.sha }}.tar
      - uses: aquasecurity/trivy-action@master
        with:
          input: oci
          format: template
          template: "@trivy/github-markdown.tpl"
          output: trivy.md
          security-checks: vuln
          ignore-unfixed: true
          severity: CRITICAL,HIGH
          exit-code: 1
      - run: cat trivy.md >> $GITHUB_STEP_SUMMARY
        if: always()

[knqyf263]

Thanks for your proposal. Please let us see how much this feature is needed in the community to decide if we will accept this proposal.

[michadvorak-cen38289]

Just stumbled on the exactly same issue, please add this template, thanks!

[michadvorak-cen38289]

@ohmer You can actually output directly to step summary, even thou it is missing in the documentation (I'm pretty sure by accident), via ${{ github.step_summary }}

- uses: aquasecurity/trivy-action@master
  with:
    format: template
    template: "@trivy/github-markdown.tpl"
    output: ${{ github.step_summary }}

[saerosV]

I think this is a great addition to Trivy, it would greatly benefit people who don't have access to GitHub Advanced Security.

A similar feature was already proposed and discussed earlier this year, in the Trivy Action repository, but the maintainers there apparently put it on hold.

@knqyf263

[knqyf263]

Thank you guys for your thoughts. We'll look into @ohmer's PR.

[github-actions]

This issue is stale because it has been labeled with inactivity.

[tperka-catalogicsoftware]

Is it implemented now? I would also love to use this

[saerosV]

@michadvorak-cen38289

Were you able to make the following piece of code work, with an existing format or template?

- uses: aquasecurity/trivy-action@master
  with:
    format: template
    template: "@trivy/github-markdown.tpl"
    output: ${{ github.step_summary }}

I tested it with the markdown template ("@trivy/github-markdown.tpl") and other formats, but all I got in return was the following error:

flag error: report flag error: failed to create an output file: open /home/runner/work/_temp/_runner_file_commands/step_summary_id-number: no such file or directory

[dstrates]

@michadvorak-cen38289 @saerosV

I'm receiving the same error in a GitHub hosted runner. Any tips?

I assumed the markdown template needs to exist in the GitHub workspace context and that we prefix this with @ (i.e. "@github-markdown.tpl") as per the documentation examples.

[saerosV]

Hi @dstrates.

Correct, the template needs to exist.

I tested using the HTML template:

format: template
template: "@/contrib/html.tpl"
output: ${{ github.step_summary }}

and the table format, but still got the same results.

[dstrates]

FWIW ohmer's original example works fine with the separate step:

      - uses: aquasecurity/trivy-action@master
        with:
          input: oci
          format: template
          template: "@trivy/github-markdown.tpl"
          output: trivy.md
          security-checks: vuln
          ignore-unfixed: true
          severity: CRITICAL,HIGH
          exit-code: 1
  - run: cat trivy.md >> $GITHUB_STEP_SUMMARY
        if: always()

[github-actions]

This issue is stale because it has been labeled with inactivity.

[saerosV]

This issue can now be closed since #3202 (related PR) was also closed.

@itaysk.

[AshwinSarimin]

I have solved this by creating the markdown.tpl in the repository, with the content provided by ohmer (https://github.com/aquasecurity/trivy/pull/3202/files), and with the following code I am able to the results in the job summary:

- name: Run Trivy config scanner - High,Critical
      uses: aquasecurity/trivy-action@master
      with:
        scan-ref: ${{ inputs.moduleFolderPath }}
        scan-type: 'config'
        hide-progress: false
        exit-code: '1'
        ignore-unfixed: true
        severity: 'CRITICAL,HIGH'
        format: template
        template: "@/github/workspace/software/trivy/templates/markdown.tpl"
        output: trivy-high-critical.md

Because the Trivy scanner runs inside a docker instance, it mounts the checked out repository as a volume inside that container. The volume is mounted as:

-v "/home/runner/work/REPOSITORY":"/github/workspace"

So to be able the retrieve the markdown template from the repository I have to use '@/github/workspace/' and then the template file location (software/trivy/templates/markdown.tpl)

Not my preferred way of doing this, but it works.

[pantelis-karamolegkos]

does this template 👉🏻 @trivy/github-markdown.tpl still exist?
does it need to be fetched locally or is the reference made directly to the remote repo of trivy?

I am getting the following error

Fatal error	report error: unable to write results: failed to initialize template writer: error retrieving template from path: open trivy/github-markdown.tpl: no such file or directory

[itaysk]

trivy never had a build it markdown template #3202 (comment)

[pantelis-karamolegkos]

What is the usefulness of the github output type? The output is not readable in the step summary when using it.

[itaysk]

https://github.blog/2022-07-01-extend-your-dependency-information-in-the-github-dependency-graph-with-new-github-actions/

[pantelis-karamolegkos]

So @itaysk the github format is only for dependency information and does not produce reports for image vulnerabilities?

edit: I mean it cannot be used to update the GitHub actions summary with a report of the vulnerabilities found?

[itaysk]

yes github format was created only for github's dependencies tab integration

[VegardEikenes]

This feature is still needed, especially when using reusable workflows. This should be easy to implement, as the template is already written.