container-scan-to-sarif
container-scan-to-sarif converts Azure Container Scan Action output to Static Analysis Results Interchange Format (SARIF), for an easier integration with GitHub Code Scanning.
Rationale
The Azure Container Scan Action combines both Trivy and Dockle tools to scan container images for common vulnerabilities (CVEs) and best practices violations. It also provides with the ability to ignore some checks if needed, via an allowedlist.yaml file.
This is all great, but the resulting output is a non-standard JSON file, which, at this time, can only be uploaded as a build artifact, making it hard to read the report or integrate with other tools.
On the other hand, GitHub Code Scanning integrates very well with external tools that are able to produce Static Analysis Results Interchange Format (SARIF) reports, so users can navigate their reports in the nice "Code Scanning Alerts" interface.
This is where container-scan-to-sarif comes into play, by bridging the gap between Container Scan and GitHub Code Scanning.
It also started as a learning exercise for myself to use Golang in practice.
Installation
You can download the latest release of container-scan-to-sarif.
Or, from the sources:
go install github.com/rm3l/container-scan-to-sarif@latest
Usage
Container image
Container images for container-scan-to-sarif are pushed to GitHub Packages. You can therefore run it with Docker, by mounting your Container Scan output inside the container, like so:
docker container run --rm \
-v /path/to/my/container-scan-report.json:/data/scanreport.json \
-t ghcr.io/rm3l/container-scan-to-sarif
CLI
container-scan-to-sarif --help
Usage of container-scan-to-sarif:
-input string
Path to the Azure Container Scan JSON Report (default "./scanreport.json")
-output string
Path to the SARIF output file. Default output is STDOUT
Building from source
Once you have cloned this repo, you can build container-scan-to-sarif with the command below:
# Build
go build
# The executable can the be found here: ./container-scan-to-sarif
./container-scan-to-sarif --help
Contribution Guidelines
Contributions and issue reporting are more than welcome. So to help out, do feel free to fork this repo and open up a pull request. I'll review and merge your changes as quickly as possible.
You can use GitHub issues to report bugs. However, please make sure your description is clear enough and has sufficient instructions to be able to reproduce the issue.
Developed by
- Armel Soro
License
The MIT License (MIT)
Copyright (c) 2021 Armel Soro
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
