container-scan-to-sarif converts Azure Container Scan Action output to Static Analysis Results Interchange Format (SARIF), for an easier integration with GitHub Code Scanning.
The Azure Container Scan Action combines both Trivy and Dockle tools to scan container images for common vulnerabilities (CVEs) and best practices violations. It also provides with the ability to ignore some checks if needed, via an
This is all great, but the resulting output is a non-standard JSON file, which, at this time, can only be uploaded as a build artifact, making it hard to read the report or integrate with other tools.
On the other hand, GitHub Code Scanning integrates very well with external tools that are able to produce Static Analysis Results Interchange Format (SARIF) reports, so users can navigate their reports in the nice "Code Scanning Alerts" interface.
This is where
container-scan-to-sarif comes into play, by bridging the gap between Container Scan and GitHub Code Scanning.
It also started as a learning exercise for myself to use Golang in practice.
You can download the latest release of
Or, from the sources:
go install github.com/rm3l/container-scan-to-sarif@latest
Container images for
container-scan-to-sarif are pushed to GitHub Packages. You can therefore run it with Docker, by mounting your Container Scan output inside the container, like so:
docker container run --rm \
-v /path/to/my/container-scan-report.json:/data/scanreport.json \
Usage of container-scan-to-sarif:
Path to the Azure Container Scan JSON Report (default "./scanreport.json")
Path to the SARIF output file. Default output is STDOUT
Building from source
Once you have cloned this repo, you can build
container-scan-to-sarif with the command below:
# The executable can the be found here: ./container-scan-to-sarif
Contributions and issue reporting are more than welcome. So to help out, do feel free to fork this repo and open up a pull request. I'll review and merge your changes as quickly as possible.
You can use GitHub issues to report bugs. However, please make sure your description is clear enough and has sufficient instructions to be able to reproduce the issue.
The MIT License (MIT)
Copyright (c) 2021 Armel Soro
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE