fix(aqua-csp): Write report without vulnerability items #9
Conversation
The Vulnerability CRD has schema validation which does not allow persising null vulnerability items. It has to be an empty array. Signed-off-by: Daniel Pacak <[email protected]>
Codecov Report
@@ Coverage Diff @@
## master #9 +/- ##
=========================================
Coverage ? 29.54%
=========================================
Files ? 2
Lines ? 176
Branches ? 0
=========================================
Hits ? 52
Misses ? 123
Partials ? 1
Continue to review full report at Codecov.
|
| @@ -33,7 +33,7 @@ func (c *converter) Convert(in io.Reader) (starboard.VulnerabilityReport, error) | |||
| } | |||
|
|
|||
| func (c *converter) convert(aquaReport ScanReport) (starboardReport starboard.VulnerabilityReport) { | |||
| var items []starboard.VulnerabilityItem | |||
| items := make([]starboard.VulnerabilityItem, 0) | |||
There was a problem hiding this comment.
Nit (which you are welcome to ignore!) - personally I marginally prefer simple declaration rather than zero-length make for slices, because it's one fewer allocation. That is absolutely negligible here so really not important!
There was a problem hiding this comment.
Yes. I agree. I did that only for the side effect of JSON encoder, i.e. to serialize vulnerabilities property to [] instead of null. Otherwise OpenAPI schema validation that we have for vulnerabilities.aquasecurity.github.io would fail.
| name string | ||
|
|
||
| expectedReport v1alpha1.VulnerabilityReport | ||
| }{ |
There was a problem hiding this comment.
Is it possible to get a report with some resources, but no vulnerabilities for those resources?
There was a problem hiding this comment.
I believe it's not possible because we do not pass the --full-output flag to the scannercli scan command. However, we do ignore Negligible vulnerabilities, because we do not have such qualitative severity in the vulnerabilities CRD.
The Vulnerability CRD has schema validation which does not
allow persising null vulnerability items. It has to be an
empty array.
Signed-off-by: Daniel Pacak [email protected]