container-scan-to-sarif

container-scan-to-sarif converts Azure Container Scan Action output to Static Analysis Results Interchange Format (SARIF), for an easier integration with tools like GitHub Code Scanning.

Rationale

The Azure Container Scan Action combines both Trivy and Dockle tools to scan container images for common vulnerabilities (CVEs) and best practices violations. It also provides with the ability to ignore some checks if needed, via an allowedlist.yaml file.

This is all great, but the resulting output is a non-standard JSON file, which, at this time, makes it hard to read across different CI runs or integrate with other tools.

On the other hand, GitHub Code Scanning integrates very well with external tools that are able to produce Static Analysis Results Interchange Format (SARIF) reports, so users can navigate their reports in the nice "Code Scanning Alerts" interface.

This is where container-scan-to-sarif comes into play, by bridging the gap between Container Scan and other tools that support SARIF standard reports, like GitHub Code Scanning.

It also started as a learning exercise for myself to use Go in practice.

Installation

You can download the latest release of container-scan-to-sarif.

Or, from the sources:

go install github.com/rm3l/container-scan-to-sarif/cmd/container-scan-to-sarif@latest

Usage

In GitHub Workflows

You may want to use the following Action in your Workflows: rm3l/container-scan-to-sarif-action, like so:

  - name: Scan Container Image
    id: scan
    continue-on-error: true
    uses: Azure/container-scan@v0.1
    with:
      image-name: my-container-image

  - name: Convert Container Scan Report to SARIF
    id: scan-to-sarif
    uses: rm3l/container-scan-to-sarif-action@v1
    if: ${{ always() }}
    with:
      input-file: ${{ steps.scan.outputs.scan-report-path }}

  - name: Upload SARIF reports to GitHub Security tab
    uses: github/codeql-action/upload-sarif@v1
    if: ${{ always() }}
    with:
      sarif_file: ${{ steps.scan-to-sarif.outputs.sarif-report-path }}

After your Workflow run passes, you should then be able to navigate the container scan report under your "Security > Code scanning alerts" tab.

Standalone executable

Container image

Container images for container-scan-to-sarif are pushed to GitHub Packages. You can therefore run it with Docker, by mounting your Container Scan output inside the container, like so:

The working directory inside the container is set to /data. So you can just mount your Container Scan report under a /data/scanreport.json and run container-scan-to-sarif.

docker container run --rm \
  -v /path/to/my/container-scan-report.json:/data/scanreport.json \
  -t ghcr.io/rm3l/container-scan-to-sarif 

Alternatively, you can specify a different path (in the container), like so:

docker container run --rm \
  -v /path/to/my/container-scan-report.json:/tmp/my-scanreport.json \
  -t ghcr.io/rm3l/container-scan-to-sarif \
  -input /tmp/my-scanreport.json

CLI

container-scan-to-sarif --help

Usage of ./container-scan-to-sarif:
  -input string
        path to the Container Scan JSON Report (default "./scanreport.json")

Building from source

Once you have cloned this repo and installed Go, you can build container-scan-to-sarif with the command below:

# Build
go build -o ./container-scan-to-sarif cmd/container-scan-to-sarif/main.go

# The executable can the be found here: ./container-scan-to-sarif
./container-scan-to-sarif --help

Contribution Guidelines

Contributions and issue reporting are more than welcome. So to help out, do feel free to fork this repo and open up a pull request. I'll review and merge your changes as quickly as possible.

You can use GitHub issues to report bugs. However, please make sure your description is clear enough and has sufficient instructions to be able to reproduce the issue.

Developed by

• Armel Soro
  • keybase.io/rm3l
  • rm3l.org - <armel+container-scan-to-sarif@rm3l.org> - @rm3l
  • paypal.me/rm3l
  • coinbase.com/rm3l

License

The MIT License (MIT)

Copyright (c) 2021-2022 Armel Soro

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.