Feature/container scan by andrzej-janczak · Pull Request #194 · codacy/codacy-cli-v2

andrzej-janczak · 2026-02-02T09:25:24Z

tested:

go run cli-v2.go container-scan alpine:3.7
🔍 Scanning container image: alpine:3.7

2026-02-02T10:32:54+01:00       INFO    [vuln] Vulnerability scanning is enabled
2026-02-02T10:32:56+01:00       INFO    Detected OS     family="alpine" version="3.7.3"
2026-02-02T10:32:56+01:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.7" repository="3.7" pkg_num=13
2026-02-02T10:32:56+01:00       WARN    This OS version is no longer supported by the distribution      family="alpine" version="3.7.3"
2026-02-02T10:32:56+01:00       WARN    The vulnerability detection may be insufficient because security updates are not provided

Report Summary

┌───────────────────────────┬────────┬─────────────────┐
│          Target           │  Type  │ Vulnerabilities │
├───────────────────────────┼────────┼─────────────────┤
│ alpine:3.7 (alpine 3.7.3) │ alpine │        2        │
└───────────────────────────┴────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


alpine:3.7 (alpine 3.7.3)

Total: 2 (HIGH: 0, CRITICAL: 2)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ musl       │ CVE-2019-14697 │ CRITICAL │ fixed  │ 1.1.18-r3         │ 1.1.18-r4     │ musl libc through 1.1.23 has an x87 floating-point stack │
│            │                │          │        │                   │               │ adjustment im ......                                     │
│            │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2019-14697               │
├────────────┤                │          │        │                   │               │                                                          │
│ musl-utils │                │          │        │                   │               │                                                          │
│            │                │          │        │                   │               │                                                          │
│            │                │          │        │                   │               │                                                          │
└────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.69.0 of Trivy is now available, current version is 0.66.0

To suppress version checks, run Trivy scans with the --skip-version-check flag


❌ Scanning failed: vulnerabilities found in the container image
exit status 1

go run cli-v2.go container-scan alpine:latest
🔍 Scanning container image: alpine:latest

2026-02-02T10:33:23+01:00       INFO    [vuln] Vulnerability scanning is enabled
2026-02-02T10:33:25+01:00       INFO    Detected OS     family="alpine" version="3.23.3"
2026-02-02T10:33:25+01:00       WARN    This OS version is not on the EOL list  family="alpine" version="3.23"
2026-02-02T10:33:25+01:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.23" repository="3.23" pkg_num=16

Report Summary

┌───────────────────────────────┬────────┬─────────────────┐
│            Target             │  Type  │ Vulnerabilities │
├───────────────────────────────┼────────┼─────────────────┤
│ alpine:latest (alpine 3.23.3) │ alpine │        0        │
└───────────────────────────────┴────────┴─────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


📣 Notices:
  - Version 0.69.0 of Trivy is now available, current version is 0.66.0

To suppress version checks, run Trivy scans with the --skip-version-check flag


✅ Success: No vulnerabilities found matching the specified criteria

… update related tests. Removed support for multiple images in command usage and adjusted the execution logic accordingly.

…o CommandRunner interface and implementing isScanFailure check. Introduced tests for scan failure scenarios and updated MockCommandRunner to support stderr handling.

…Adjusted rule indices for existing vulnerabilities and added a new entry for eslint vulnerability CVE-2025-50537.

codacy-production · 2026-02-02T09:26:23Z

Codacy's Analysis Summary

0 new issue (≤ 1 medium issue)
0 new security issue (≤ 0 issue)
90 complexity
3 duplications

Review Pull Request in Codacy →

✨ AI Reviewer available: add the codacy-review label to get contextual insights without leaving GitHub.

codacy-production · 2026-02-02T09:27:09Z

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ +1.61% (target: -0.50%)	✅ 74.17% (target: 50.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (`e1bb1bc`)	5798	1179	20.33%
Head commit (`e4b5e94`)	5948 (+150)	1305 (+126)	21.94% (+1.61%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#194)	151	112	74.17%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings Change summary preferences

Copilot

Pull request overview

This PR introduces a new container-scan command that leverages Trivy to scan container images for vulnerabilities, and adjusts configuration/validation paths so it can run without a codacy.yaml. It also updates the Trivy SARIF expected output and adds comprehensive tests around the new behavior and arguments.

Changes:

Add container-scan Cobra command, including image-name validation, Trivy auto-install/lookup, error handling, and argument construction for Trivy.
Exempt container-scan from configuration validation and from requiring an existing codacy.yaml when invoked from main.
Update Trivy SARIF expected output fixture to account for new vulnerability findings and rule indices, and add extensive unit tests for the new command and helpers.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`plugins/tools/trivy/test/expected.sarif`	Updates the expected Trivy SARIF output (including a new eslint CVE entry and adjusted `ruleIndex` values) to align tests with the current Trivy behavior.
`cmd/validation.go`	Extends the `shouldSkipValidation` list so `container-scan` bypasses `codacy.yaml` validation, matching its design to work without project config.
`cmd/container_scan.go`	Implements the `container-scan` command, including Docker image name validation, Trivy path resolution and installation, scan execution with stderr classification between “scan failed” vs “vulns found”, and argument building based on flags.
`cmd/container_scan_test.go`	Adds unit tests covering `getTrivyPath`, `executeContainerScan` exit-code behavior, image name validation, Trivy argument construction, command argument rules, flag defaults, and the validation-skip behavior for `container-scan`.
`cli-v2.go`	Adjusts `main` so `container-scan` is treated like `init/update/version/help` and can run even when the project configuration file is missing or invalid.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-02T11:37:18Z

cmd/container_scan.go

+	trivyPath, err := getTrivyPath()
+	if err != nil {
+		handleTrivyNotFound(err)
+		return 2
+	}


executeContainerScan both calls handleTrivyNotFound(err) (which invokes exitFunc(2)) and then returns 2, which runContainerScan passes again to exitFunc. In production this double-exit isn’t observable because os.Exit terminates the process immediately, but it mixes responsibilities for exiting between lower- and higher-level helpers and forces the tests to stub exitFunc around both places. To simplify control flow and make the code easier to reason about and test, consider having executeContainerScan only return an exit code (for example by changing handleTrivyNotFound to just log and return a code) and let runContainerScan be the single place that calls exitFunc.

franciscoovazevedo · 2026-02-02T11:50:57Z

cmd/container_scan.go

+		args = append(args, "--ignore-unfixed")
+	}
+
+	// Apply --severity (use default if not specified)


franciscoovazevedo · 2026-02-02T11:51:02Z

cmd/container_scan.go

+		"--scanners", "vuln",
+	}
+
+	// Apply --ignore-unfixed if enabled (default: true)


we should not allow users to define this flags

franciscoovazevedo · 2026-02-02T11:51:33Z

cmd/container_scan.go

+	}
+	args = append(args, "--severity", severity)
+
+	// Apply --pkg-types (use default if not specified)


flags are removed

…s flags. Default values for severity and package types are now hardcoded in the buildTrivyArgs function. Updated related tests to reflect these changes.

franciscoovazevedo and others added 9 commits January 19, 2026 14:42

add container-scan command to trivy scan containers

c8c5182

add tests and codacy suggestion improvments

25dcb9b

allow list of images as argument

9539333

codacy and copilot review changes applied

078a26a

add tests and codacy vulns fixed

d4d0d2c

not use PATH

027955b

Refactor container scan command to accept a single image argument and…

3635fa0

… update related tests. Removed support for multiple images in command usage and adjusted the execution logic accordingly.

Enhance container scan functionality by adding RunWithStderr method t…

7fe9d0f

…o CommandRunner interface and implementing isScanFailure check. Introduced tests for scan failure scenarios and updated MockCommandRunner to support stderr handling.

Update expected SARIF output for vulnerability rules in Trivy tests. …

df0ffea

…Adjusted rule indices for existing vulnerabilities and added a new entry for eslint vulnerability CVE-2025-50537.

Copilot AI review requested due to automatic review settings February 2, 2026 09:25

Copilot started reviewing on behalf of andrzej-janczak February 2, 2026 09:25 View session

Copilot AI reviewed Feb 2, 2026

View reviewed changes

franciscoovazevedo requested a review from Copilot February 2, 2026 11:31

Copilot started reviewing on behalf of franciscoovazevedo February 2, 2026 11:32 View session

Copilot AI reviewed Feb 2, 2026

View reviewed changes

franciscoovazevedo reviewed Feb 2, 2026

View reviewed changes

Refactor container scan command by removing severity and package type…

e4b5e94

…s flags. Default values for severity and package types are now hardcoded in the buildTrivyArgs function. Updated related tests to reflect these changes.

franciscoovazevedo approved these changes Feb 2, 2026

View reviewed changes

andrzej-janczak merged commit da0cd76 into main Feb 2, 2026
10 checks passed

andrzej-janczak deleted the feature/container-scan branch February 2, 2026 13:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/container scan#194

Feature/container scan#194
andrzej-janczak merged 10 commits intomainfrom
feature/container-scan

andrzej-janczak commented Feb 2, 2026 •

edited

Loading

Uh oh!

codacy-production bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

codacy-production bot commented Feb 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

franciscoovazevedo Feb 2, 2026 •

edited

Loading

Uh oh!

franciscoovazevedo Feb 2, 2026 •

edited

Loading

Uh oh!

franciscoovazevedo Feb 2, 2026

Uh oh!

andrzej-janczak Feb 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

andrzej-janczak commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codacy-production bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codacy's Analysis Summary

Uh oh!

codacy-production bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage summary from Codacy

See diff coverage on Codacy

See your quality gate settings Change summary preferences

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

franciscoovazevedo Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

franciscoovazevedo Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

franciscoovazevedo Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

andrzej-janczak Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

andrzej-janczak commented Feb 2, 2026 •

edited

Loading

codacy-production bot commented Feb 2, 2026 •

edited

Loading

codacy-production bot commented Feb 2, 2026 •

edited

Loading

franciscoovazevedo Feb 2, 2026 •

edited

Loading

franciscoovazevedo Feb 2, 2026 •

edited

Loading