platform(sca): Add images data to image_cached_results for ImageReferencer scan

checkov/common/images/image_referencer.py

@@ -10,6 +10,8 @@
 import docker
 
 from checkov.common.bridgecrew.vulnerability_scanning.image_scanner import image_scanner
+from checkov.common.bridgecrew.vulnerability_scanning.integrations.docker_image_scanning import \
+    docker_image_scanning_integration
 from checkov.common.output.common import ImageDetails
 from checkov.common.output.report import Report, CheckType
 from checkov.common.runners.base_runner import strtobool
@@ -119,6 +121,7 @@ def check_container_image_references(
         runner_filter: RunnerFilter,
     ) -> Report | None:
         """Tries to find image references in graph based IaC templates"""
+        from checkov.common.bridgecrew.platform_integration import bc_integration
 
         # skip complete run, if flag '--check' was used without a CVE check ID
         if runner_filter.checks and all(not check.startswith("CKV_CVE") for check in runner_filter.checks):
@@ -144,6 +147,7 @@ def check_container_image_references(
                 image=image,
                 runner_filter=runner_filter,
                 report_type=report_type,
+                bc_integration=bc_integration,
             )
 
         return report
@@ -157,12 +161,21 @@ def add_image_records(
         image: Image,
         runner_filter: RunnerFilter,
         report_type: str,
+        bc_integration: BcPlatformIntegration,
     ) -> None:
         """Adds an image record to the given report, if possible"""
 
         cached_results: dict[str, Any] = image_scanner.get_scan_results_from_cache(f"image:{image.name}")
         if cached_results:
             logging.info(f"Found cached scan results of image {image.name}")
+            payload: dict[str, Any] = docker_image_scanning_integration.create_report(
+                twistcli_scan_result=cached_results,
+                bc_platform_integration=bc_integration,
+                file_path=dockerfile_path,
+                file_content=f'image: {image.name}',
+                docker_image_name=image.name,
+                related_resource_id=image.related_resource_id)
+            report.image_cached_results.append(payload)
 
             result = cached_results.get("results", [{}])[0]
             image_id = self.extract_image_short_id(result)

checkov/terraform/image_referencer/base_provider.py

@@ -1,11 +1,13 @@
 from __future__ import annotations
 
+import os
 from typing import TYPE_CHECKING, Callable, Any
 
 from hcl2 import START_LINE, END_LINE
 
 from checkov.common.graph.graph_builder import CustomAttributes
 from checkov.common.images.image_referencer import Image
+from checkov.common.util.str_utils import removeprefix
 
 if TYPE_CHECKING:
     from networkx import DiGraph
@@ -49,6 +51,7 @@ def extract_images_from_resources(self) -> list[Image]:
                         name=name,
                         start_line=resource[START_LINE],
                         end_line=resource[END_LINE],
+                        related_resource_id=f'{removeprefix(resource.get("file_path_"), os.getenv("BC_ROOT_DIR", ""))}:{resource.get("id_")}'
                     )
                 )
 

tests/terraform/image_referencer/provider/test_aws.py

@@ -43,13 +43,15 @@ def test_extract_images_from_resources():
             file_path="/ecs.tf",
             name="nginx",
             start_line=1,
-            end_line=31
+            end_line=31,
+            related_resource_id='/ecs.tf:None'
         ),
         Image(
             file_path="/ecs.tf",
             name="python:3.9-alpine",
             start_line=1,
-            end_line=31
+            end_line=31,
+            related_resource_id='/ecs.tf:None'
         ),
     ]
 

tests/terraform/image_referencer/test_manager.py

@@ -46,6 +46,6 @@ def test_extract_images_from_resources():
 
     # then
     assert images == [
-        Image(file_path="/ecs.tf", name="nginx", start_line=1, end_line=31),
-        Image(file_path="/batch.tf", name="python:3.9-alpine", start_line=1, end_line=25),
+        Image(file_path="/ecs.tf", name="nginx", start_line=1, end_line=31, related_resource_id='/ecs.tf:None'),
+        Image(file_path="/batch.tf", name="python:3.9-alpine", start_line=1, end_line=25, related_resource_id='/batch.tf:None'),
     ]

tests/terraform/image_referencer/test_runner_aws_resources.py

@@ -1,7 +1,9 @@
+import os
 from pathlib import Path
 
 from pytest_mock import MockerFixture
 
+from checkov.common.bridgecrew.bc_source import get_source_type
 from checkov.common.output.report import CheckType
 from checkov.runner_filter import RunnerFilter
 from checkov.terraform.runner import Runner
@@ -10,12 +12,15 @@
 
 
 def test_apprunner_resources(mocker: MockerFixture, image_cached_result, license_statuses_result):
+    from checkov.common.bridgecrew.platform_integration import bc_integration
+
     # given
     file_name = "apprunner.tf"
     image_name = "public.ecr.aws/aws-containers/hello-app-runner:latest"
     code_lines = "1-23"
     test_file = RESOURCES_PATH / file_name
     runner_filter = RunnerFilter(run_image_referencer=True)
+    bc_integration.bc_source = get_source_type('disabled')
 
     mocker.patch(
         "checkov.common.images.image_referencer.image_scanner.get_scan_results_from_cache",
@@ -47,8 +52,17 @@ def test_apprunner_resources(mocker: MockerFixture, image_cached_result, license
         f"{file_name} ({image_name} lines:{code_lines} (sha256:f9b91f78b0)).openssl",
         f"{file_name} ({image_name} lines:{code_lines} (sha256:f9b91f78b0)).zlib",
     }
+    assert sca_image_report.image_cached_results[0]['dockerImageName'] == \
+           'public.ecr.aws/aws-containers/hello-app-runner:latest'
+    assert 'terraform/image_referencer/resources/aws/apprunner.tf:aws_apprunner_service.example' in \
+           sca_image_report.image_cached_results[0]['relatedResourceId']
+    assert sca_image_report.image_cached_results[0]['packages'] == [
+        {'type': 'os', 'name': 'zlib', 'version': '1.2.12-r1', 'licenses': ['Zlib']}
+    ]
+
     assert len(sca_image_report.passed_checks) == 1
     assert len(sca_image_report.failed_checks) == 2
+    assert len(sca_image_report.image_cached_results) == 1
     assert len(sca_image_report.skipped_checks) == 0
     assert len(sca_image_report.parsing_errors) == 0