feat(cmd): add project and docker subcommands to scan
#1519
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1519 +/- ##
==========================================
- Coverage 68.98% 68.81% -0.18%
==========================================
Files 197 200 +3
Lines 18800 18891 +91
==========================================
+ Hits 12970 13000 +30
- Misses 5127 5171 +44
- Partials 703 720 +17 ☔ View full report in Codecov by Sentry. |
| exit: 127, | ||
| }, | ||
| // TODO: How to prevent these snapshots from changing constantly | ||
| { | ||
| name: "Real empty image", | ||
| args: []string{"", "--docker", "hello-world"}, | ||
| args: []string{"", "scan", "docker", "hello-world"}, |
There was a problem hiding this comment.
what if someone passes osv-scanner scan docker where docker is a valid directory? Similarly for osv-scanner scan project.
Do we need to handle that in a special way, with a warning printed to users?
|
|
||
| const DefaultSubcommand = projectSubCommand | ||
|
|
||
| var Subcommands = []string{projectSubCommand, "docker"} |
There was a problem hiding this comment.
to future proof this, should we instead make this "osv-scanner scan container" as opposed to docker?
| "experimental-licenses-summary": "false", | ||
| // "experimental-licenses": "", // StringSliceFlag has to be manually cleared. | ||
| } | ||
| const projectSubCommand = "project" |
There was a problem hiding this comment.
"project" seems a bit ambiguous. How about "source" ? to distinguish this as a scanner for source context (i.e. scanning manifests etc)
This change does not break any existing behaviour.
projectanddockersubcommands forscan.projectas the default subcommand if none is provided.experimental-oci-imageflag and its tests.For project scanning, users can use the following commands:
osv-scanner <file_name>osv-scanner scan <file_name>osv-scanner scan project <file_name>For docker scanning, users can use the following commands:
osv-scanner scan docker <docker_image>osv-scanner scan docker <docker_image.tar>