Closed scrthq closed 6 months ago
$ cat ash_stdout.txt
Resolved OCI_RUNNER to: /usr/bin/docker
Building image automated-security-helper:local -- this may take a few minutes during the first build...
Running ASH scan using built image...
ASH version 1.2.0-e-06Mar2024
Repository cloned successfully.
Source is a git repository. Using git ls-files to exclude files from scanning.
ASH found 59 file(s) in the source directory...
Items to scan for in Dockerfile-cdk are: [ yaml yml json template ]
Items to scan for in Dockerfile-yaml are: [ yaml yml tf json dockerfile ]
Running cdk-docker-execute.sh ...
Running yaml-docker-execute.sh ...
waiting on Dockerfile-cdk to finish ...
Items to scan for in Dockerfile-py are: [ py pyc ipynb ]
Items to scan for in Dockerfile-js are: [ js ]
Items to scan for in Dockerfile-git are: [ git ]
Items to scan for in Dockerfile-grype are: [ js py java go cs sh ]
Running js-docker-execute.sh ...
Running grype-docker-execute.sh ...
Running py-docker-execute.sh ...
Running git-docker-execute.sh ...
Dockerfile Dockerfile-js returned 0
Dockerfile Dockerfile-git returned 0
Dockerfile Dockerfile-py returned 0
Dockerfile Dockerfile-cdk returned 0
Dockerfile-cdk finished with return code 0
waiting on Dockerfile-yaml to finish ...
Dockerfile Dockerfile-grype returned 0
Dockerfile Dockerfile-yaml returned 0
Dockerfile-yaml finished with return code 0
waiting on Dockerfile-git to finish ...
Dockerfile-git finished with return code 0
waiting on Dockerfile-py to finish ...
Dockerfile-py finished with return code 0
waiting on Dockerfile-js to finish ...
Dockerfile-js finished with return code 0
waiting on Dockerfile-grype to finish ...
Dockerfile-grype finished with return code 0
Jobs return code report:
Dockerfile-cdk : 0
Dockerfile-yaml : 0
Dockerfile-git : 0
Dockerfile-py : 0
Dockerfile-js : 0
Dockerfile-grype : 0
Your final report can be found here: /home/runner/work/automated-security-helper/automated-security-helper/ash_output/aggregated_results.txt
ASH execution completed in 24 seconds.
Highest return code is 0
Changes look good to me.
My only comment is that the Github action step which runs ash on itself seems to write the output folder "under" the source source folder. That might confuse some of the scanners by having files in the "source" area changing mid-scan".
Approving.
Thanks, @climbertjh2 ! We can write it out somewhere else if it makes sense, but that's purely for this repo's pipeline. If we see it in the scan, I agree it should go somewhere else though. Easy to fix, will check it out and push one more change if it's causing trouble.
still looks OK to me. Approving.
Thank you, sir! I checked the aggregated results and wasn't seeing it in the scan list either.
LGTM, awesome work!
Issue #, if available:
42
Description of changes:
public.ecr.aws/bitnami/python:3.10
topublic.ecr.aws/docker/library/python:3.10-bullseye
to allow builds for linux/arm64 platforms to workash
script has been renamed toash-multi
if multi-container architecture is needed from local. When running in the single-container, this is copied in asash
itself and becomes the entrypoint of the in-container run to prevent API changes for CI invocations.ash
script for local invocation entrypoint is now defaulting to building the single-container image and running the scan within as normalaggregated_results.txt
now shows the correct, local output path when using the single container instead of/out/aggregated_results.txt
ash
script as well to validate the entire experience end-to-end--finch|-f
option with warning indicating to use--oci-runner finch|-o finch
if needing to use Finch explicitlyBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.