Skip to content

feat(cmd): add source and image subcommands to scan#1519

Merged
hogo6002 merged 21 commits intogoogle:mainfrom
hogo6002:docker_command
Jan 24, 2025
Merged

feat(cmd): add source and image subcommands to scan#1519
hogo6002 merged 21 commits intogoogle:mainfrom
hogo6002:docker_command

Conversation

@hogo6002
Copy link
Copy Markdown
Contributor

@hogo6002 hogo6002 commented Jan 21, 2025 •
edited
Loading

This change does not break any existing behaviour.

  • Creates source and image subcommands for scan.
  • Inserts source as the default subcommand if none is provided.
  • Removes the experimental-oci-image flag and its tests.
  • Adds a feedback link to HTML output

For project scanning, users can use the following commands:

  • osv-scanner <file_name>
  • osv-scanner scan <file_name>
  • osv-scanner scan source <file_name>

For docker scanning, users can use the following commands:

  • osv-scanner scan image <docker_image>
  • osv-scanner scan image --archive <docker_image.tar>

Help command:

NAME:
  osv-scanner - scans various mediums for dependencies and checks them against the OSV database

USAGE:
  osv-scanner [global options] command [command options]

EXAMPLES:
  # Scan a source directory
  $ osv-scanner scan source -r <source_directory>

  # Scan a container image
  $ osv-scanner scan image <image_name>

  # Scan a local image archive (e.g. a tar file) and generate HTML output
  $ osv-scanner scan image --serve --archive <image_name.tar>

  # Fix vulnerabilities in a manifest file and lockfile (non-interactive mode)
  $ osv-scanner fix --non-interactive -M <manifest_file> -L <lockfile>

  For full usage details, please refer to the help command of each subcommand (e.g. osv-scanner scan --help).

VERSION:
  1.9.1

COMMANDS:
  scan     scans projects and container images for dependencies, and checks them against the OSV database.
  fix      [EXPERIMENTAL] scans a manifest and/or lockfile for vulnerabilities and suggests changes for remediating them
  help, h  Shows a list of commands or help for one command


GLOBAL OPTIONS:
    --help, -h  show help  --version, -v  print the version

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Jan 21, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 61.09422% with 128 lines in your changes missing coverage. Please review.

Project coverage is 68.96%. Comparing base (905d53b) to head (f2ea2c0).
Report is 4 commits behind head on main.

Files with missing lines Patch % Lines
cmd/osv-scanner/scan/source/main.go 61.11% 37 Missing and 12 partials ⚠️
cmd/osv-scanner/scan/image/main.go 48.00% 31 Missing and 8 partials ⚠️
cmd/osv-scanner/internal/helper/helper.go 21.42% 31 Missing and 2 partials ⚠️
cmd/osv-scanner/main.go 94.02% 3 Missing and 1 partial ⚠️
pkg/osvscanner/osvscanner.go 25.00% 2 Missing and 1 partial ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #1519      +/-   ##
==========================================
- Coverage   69.08%   68.96%   -0.13%     
==========================================
  Files         197      200       +3     
  Lines       18864    18959      +95     
==========================================
+ Hits        13033    13075      +42     
- Misses       5129     5164      +35     
- Partials      702      720      +18

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

oliverchang
oliverchang reviewed Jan 22, 2025
View reviewed changes
Comment thread cmd/osv-scanner/main_test.go Outdated
Comment thread cmd/osv-scanner/scan/main.go Outdated
Comment thread cmd/osv-scanner/scan/main.go Outdated
@another-rex
Copy link
Copy Markdown
Collaborator

another-rex commented Jan 22, 2025

Let's update the osv-scanner scan docker to the original version, where we only pull images (or check existing images) in the docker engine, and have local tar files be used if you specify the --archive flag.

@hogo6002 hogo6002 requested a review from oliverchang January 23, 2025 02:29
oliverchang
oliverchang reviewed Jan 23, 2025
View reviewed changes
Comment thread cmd/osv-scanner/main.go Outdated
Comment thread cmd/osv-scanner/main.go Outdated
@hogo6002 hogo6002 requested a review from oliverchang January 23, 2025 04:35
oliverchang
oliverchang approved these changes Jan 23, 2025
View reviewed changes
Comment thread cmd/osv-scanner/main.go Outdated
Comment thread cmd/osv-scanner/main.go Outdated
@hogo6002 hogo6002 changed the title feat(cmd): add project and docker subcommands to scan feat(cmd): add source and image subcommands to scan Jan 23, 2025
another-rex
another-rex reviewed Jan 24, 2025
View reviewed changes
Copy link
Copy Markdown
Collaborator

@another-rex another-rex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just some minor comments, otherwise this looks good!

Comment thread cmd/osv-scanner/main.go Outdated
Comment thread cmd/osv-scanner/main.go Outdated
Comment thread cmd/osv-scanner/scan/helper/helper.go
Comment thread internal/output/table.go
@hogo6002 hogo6002 requested a review from another-rex January 24, 2025 01:28
@hogo6002 hogo6002 enabled auto-merge (squash) January 24, 2025 02:25
@hogo6002 hogo6002 merged commit 0e88d4f into google:main Jan 24, 2025
@hogo6002 hogo6002 deleted the docker_command branch January 30, 2025 00:25
@hogo6002 hogo6002 mentioned this pull request Feb 26, 2025
Merged
hogo6002 added a commit that referenced this pull request Feb 26, 2025
@hogo6002
fix: don't use global variable for flags (#1672)
b92eaff 
#1519 added a global variable
for shared flags has caused issues when using generic flags. For tests
running concurrently, the shared "allowlist" variable is sometimes
overwritten, leading to flaky license tests.

Thanks @michaelkedar for pointing out!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@oliverchang oliverchang oliverchang approved these changes

@another-rex another-rex another-rex approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@hogo6002 @codecov-commenter @another-rex @oliverchang