{"id":18020876,"url":"https://github.com/rm3l/container-scan-to-sarif","last_synced_at":"2025-03-26T21:32:36.618Z","repository":{"id":39670632,"uuid":"422376128","full_name":"rm3l/container-scan-to-sarif","owner":"rm3l","description":"Converts Azure Container Scan Action output to SARIF, for an easier integration with tools like GitHub Code Scanning","archived":false,"fork":false,"pushed_at":"2024-10-05T04:14:18.000Z","size":124,"stargazers_count":5,"open_issues_count":7,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-22T14:22:01.698Z","etag":null,"topics":["container-scanning","go","golang","sarif","sarif-report","security"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rm3l.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-28T22:47:20.000Z","updated_at":"2024-08-16T18:38:13.000Z","dependencies_parsed_at":"2024-06-19T15:01:20.929Z","dependency_job_id":"a551ba35-0944-49f5-bb08-435c7c4f63c6","html_url":"https://github.com/rm3l/container-scan-to-sarif","commit_stats":null,"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rm3l%2Fcontainer-scan-to-sarif","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rm3l%2Fcontainer-scan-to-sarif/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rm3l%2Fcontainer-scan-to-sarif/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rm3l%2Fcontainer-scan-to-sarif/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rm3l","download_url":"https://codeload.github.com/rm3l/container-scan-to-sarif/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245739014,"owners_count":20664382,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["container-scanning","go","golang","sarif","sarif-report","security"],"created_at":"2024-10-30T06:08:07.317Z","updated_at":"2025-03-26T21:32:31.730Z","avatar_url":"https://github.com/rm3l.png","language":"Go","funding_links":["https://paypal.me/rm3l"],"categories":[],"sub_categories":[],"readme":"# container-scan-to-sarif\n\n[![Build](https://github.com/rm3l/container-scan-to-sarif/actions/workflows/build.yml/badge.svg)](https://github.com/rm3l/container-scan-to-sarif/actions/workflows/build.yml)\n[![Lint](https://github.com/rm3l/container-scan-to-sarif/actions/workflows/lint.yml/badge.svg)](https://github.com/rm3l/container-scan-to-sarif/actions/workflows/lint.yml)\n[![Go Report Card](https://goreportcard.com/badge/github.com/rm3l/container-scan-to-sarif)](https://goreportcard.com/report/github.com/rm3l/container-scan-to-sarif)\n[![Release](https://github.com/rm3l/container-scan-to-sarif/actions/workflows/release.yml/badge.svg)](https://github.com/rm3l/container-scan-to-sarif/actions/workflows/release.yml)\n\n`container-scan-to-sarif` converts [Azure Container Scan Action](https://github.com/Azure/container-scan#action-output) output to [Static Analysis Results Interchange Format (SARIF)](https://sarifweb.azurewebsites.net/), for an easier integration with tools like [GitHub Code Scanning](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning).\n\n## Rationale\nThe [Azure Container Scan Action](https://github.com/Azure/container-scan) combines both [Trivy](https://github.com/aquasecurity/trivy) \nand [Dockle](https://github.com/goodwithtech/dockle) tools to scan container images \nfor common vulnerabilities (CVEs) and best practices violations. It also provides with the ability to ignore some checks \nif needed, via an [`allowedlist.yaml` file](https://github.com/Azure/container-scan#ignoring-vulnerabilities).\n\nThis is all great, but the resulting output is a non-standard JSON file, which, at this time, makes it hard to read across different CI runs or integrate with other tools.\n\nOn the other hand, [GitHub Code Scanning](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/about-code-scanning) integrates very well with external tools that are able to produce\n[Static Analysis Results Interchange Format (SARIF)](https://sarifweb.azurewebsites.net/) reports, so users can navigate their reports in the nice \n\"Code Scanning Alerts\" interface.\n\nThis is where `container-scan-to-sarif` comes into play, by bridging the gap between Container Scan and other tools that support SARIF standard reports, like GitHub Code Scanning.\n\nIt also started as a learning exercise for myself to use [Go](https://golang.org/) in practice.\n\n## Installation\n\nYou can download the [latest release](https://github.com/rm3l/container-scan-to-sarif/releases/latest) of `container-scan-to-sarif`.\n\nOr, from the sources:\n\n```shell\ngo install github.com/rm3l/container-scan-to-sarif/cmd/container-scan-to-sarif@latest\n```\n\n## Usage\n\n### In GitHub Workflows\n\nYou may want to use the following Action in your Workflows: [rm3l/container-scan-to-sarif-action](https://github.com/rm3l/container-scan-to-sarif-action), like so:\n\n```yaml\n  - name: Scan Container Image\n    id: scan\n    continue-on-error: true\n    uses: Azure/container-scan@v0.1\n    with:\n      image-name: my-container-image\n\n  - name: Convert Container Scan Report to SARIF\n    id: scan-to-sarif\n    uses: rm3l/container-scan-to-sarif-action@v1\n    if: ${{ always() }}\n    with:\n      input-file: ${{ steps.scan.outputs.scan-report-path }}\n\n  - name: Upload SARIF reports to GitHub Security tab\n    uses: github/codeql-action/upload-sarif@v1\n    if: ${{ always() }}\n    with:\n      sarif_file: ${{ steps.scan-to-sarif.outputs.sarif-report-path }}\n```\n\nAfter your Workflow run passes, you should then be able to navigate the container scan report under your \"Security \u003e Code scanning alerts\" tab.\n\n### Standalone executable\n\n#### Container image\n\nContainer images for `container-scan-to-sarif` are pushed to [GitHub Packages](https://github.com/rm3l/container-scan-to-sarif/pkgs/container/container-scan-to-sarif).\nYou can therefore run it with Docker, by mounting your Container Scan output inside the container, like so:\n\nThe working directory inside the container is set to `/data`. So you can just mount your Container Scan report under a `/data/scanreport.json` and run `container-scan-to-sarif`.\n```shell\ndocker container run --rm \\\n  -v /path/to/my/container-scan-report.json:/data/scanreport.json \\\n  -t ghcr.io/rm3l/container-scan-to-sarif \n```\n\nAlternatively, you can specify a different path (in the container), like so:\n```shell\ndocker container run --rm \\\n  -v /path/to/my/container-scan-report.json:/tmp/my-scanreport.json \\\n  -t ghcr.io/rm3l/container-scan-to-sarif \\\n  -input /tmp/my-scanreport.json\n```\n\n#### CLI\n\n```shell\ncontainer-scan-to-sarif --help\n\nUsage of ./container-scan-to-sarif:\n  -input string\n        path to the Container Scan JSON Report (default \"./scanreport.json\")\n```\n\n## Building from source\n\nOnce you have cloned this repo and [installed Go](https://go.dev/doc/install), you can build `container-scan-to-sarif` with the command below:\n\n```shell\n# Build\ngo build -o ./container-scan-to-sarif cmd/container-scan-to-sarif/main.go\n\n# The executable can the be found here: ./container-scan-to-sarif\n./container-scan-to-sarif --help\n```\n\n## Contribution Guidelines\n\nContributions and issue reporting are more than welcome. So to help out, do feel free to fork this repo and open up a pull request.\nI'll review and merge your changes as quickly as possible.\n\nYou can use [GitHub issues](https://github.com/rm3l/container-scan-to-sarif/issues) to report bugs.\nHowever, please make sure your description is clear enough and has sufficient instructions to be able to reproduce the issue.\n\n## Developed by\n\n* Armel Soro\n    * [keybase.io/rm3l](https://keybase.io/rm3l)\n    * [rm3l.org](https://rm3l.org) - \u0026lt;armel+container-scan-to-sarif@rm3l.org\u0026gt; - [@rm3l](https://twitter.com/rm3l)\n    * [paypal.me/rm3l](https://paypal.me/rm3l)\n    * [coinbase.com/rm3l](https://www.coinbase.com/rm3l)\n\n## License\n\n    The MIT License (MIT)\n\n    Copyright (c) 2021-2022 Armel Soro\n\n    Permission is hereby granted, free of charge, to any person obtaining a copy\n    of this software and associated documentation files (the \"Software\"), to deal\n    in the Software without restriction, including without limitation the rights\n    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n    copies of the Software, and to permit persons to whom the Software is\n    furnished to do so, subject to the following conditions:\n\n    The above copyright notice and this permission notice shall be included in all\n    copies or substantial portions of the Software.\n\n    THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n    SOFTWARE.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frm3l%2Fcontainer-scan-to-sarif","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frm3l%2Fcontainer-scan-to-sarif","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frm3l%2Fcontainer-scan-to-sarif/lists"}