Annotations support

[MPV]

Hi,
Would you consider adding support for Annotations?

See for comparison:

• https://github.com/crazy-max/ghaction-container-scan#github-annotations

[kzantow]

Hi @MPV, apologies for the delay getting back to you on this issue.

We talked about this on our livestream today, but it was a little unclear what you were hoping to accomplish, so I thought I would get a little more information and suggest something that you could do today, based on a few assumptions.

The GitHub annotations support specifying a file and line, but Grype does not capture line numbers where packages were found. It does capture files, so it would be possible to associate a vulnerability in the list to a file, but it seems like you may have just been looking for a way to show the vulnerability report in a more convenient location. If that's the case, the GitHub summary is a pretty good way to go. You could store the table output to a file, and include it in the top-level workflow like this:

      - uses: anchore/scan-action@main
        with:
          image: alpine:3.15
          fail-build: false
          output-format: table
        env:
          GRYPE_FILE: vuln-report.out

      - run: |
          VULN_REPORT="$(cat vuln-report.out)"
          printf "# Vulnerability Report Summary\n<pre>$VULN_REPORT</pre>" > $GITHUB_STEP_SUMMARY

... which results in the table output being printed right at the summary view of the workflow:

[MPV]

We talked about this on our livestream today, but it was a little unclear what you were hoping to accomplish, so I thought I would get a little more information and suggest something that you could do today, based on a few assumptions.

To be specific about what I referred to with "annotations", here's the GitHub feature (and how to use it):
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#setting-a-warning-message

The GitHub annotations support specifying a file and line, but Grype does not capture line numbers where packages were found. It does capture files, so it would be possible to associate a vulnerability in the list to a file, but it seems like you may have just been looking for a way to show the vulnerability report in a more convenient location.

While it does support specifying file/line, those fields aren't mandatory (see link above).

If that's the case, the GitHub summary is a pretty good way to go.

Yes, as many don't have GHAS (to get SARIF upload), I was thinking something like this could be helpful instead.
The summary is probably an option to using the annotations. 🤔

[svengo]

... which results in the table output being printed right at the summary view of the workflow

I couldn't get the code snippet to run, but you can use this. The variable steps.scan.outputs.table for the output file does not appear to be documented.

    -
      name: Run the Anchore Grype scan action
      uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c
      id: scan
      with:
        image: /tmp/testimage.tar
        output-format: table
        fail-build: true
        # Fail the build for critical vulnerabilities
        severity-cutoff: critical
    -
      name: Generate job summary
      id: job-summary
      run: |
        {
          IFS=$'\n'
          echo "## Vulnerability Report Summary"
          echo '```'
          cat ${{ steps.scan.outputs.table }}
          echo '```'
        } >> $GITHUB_STEP_SUMMARY

Hope that helps!