Trivy JUnit template (@contrib/junit.tpl) does not consider pass results?

[DmitriyLewen]

Discussed in #5737

^{Originally posted by jamesatribal December 6, 2023}

Description

Hello,

I am running trivy misconfiguration scanning with the --include-non-failures flag and using the @contrib/junit.tpl template to output it into a JUnit format file to be uploaded to Azure DevOps test results. The reason I've used the --include-non-failures flag is to show (in my Test results) the total number of tests that were run against my IAC, and also the number of pass/fail tests (to give the whole picture - instead of just showing the number of errors).

E.g. this is how I'm running my trivy command
trivy config --include-non-failures --format template --template "@contrib/junit.tpl" --output "/tmp/trivyReport.xml" /myiacdir

Sample summary output:
s3_bucket.tf (terraform) ======================== Tests: 285 (SUCCESSES: 225, FAILURES: 60, EXCEPTIONS: 0) Failures: 60 (UNKNOWN: 0, LOW: 15, MEDIUM: 15, HIGH: 30, CRITICAL: 0)

Using trivy version: Version: 0.47.0

Desired Behavior

From the sample summary output, I am expecting to see 285 tests, with 225 successes and 60 failures being reported

Actual Behavior

When the /tmp/trivyReport.xml report is uploaded to Azure DevOps Test results, it is correctly reporting 285 tests have been done. However, instead of reporting 225 successes and 60 failures, it is detecting it as 285 failures (i.e. all tests are considered as failures in the JUnit output)

Reproduction Steps

1. Run trivy config with the --include-non-failure flag, and use the --template @contrib/junit.tpl combined with --output flag to generate a report in JUnit format
2. Compare the pass/fail results in the summary output against the pass/fail counts in the report in JUnit format

Target

None

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Debug Output

N/A

Operating System

ubuntu 22.04 (ubuntu-latest from Azure DevOps Microsoft hosted agent)

Version

Version: 0.47.0

Checklist

• Run trivy image --reset
• Read the troubleshooting

[DmitriyLewen]

Hello @jamesatribal
I created the update for junit.tpl - #5767.
Can you take a look?

Thank you in advance!

[jamesatribal]

Hi @DmitriyLewen ,

Thanks for looking into this and coming up with a solution so promptly.

Looks good to me, thanks!

Cheers,
James