remove all fields from trivy result json that are dependent on file p…

…aths or image hashes
opencrvs · Oct 29, 2024 · 043f73f · 043f73f
1 parent 2f630b3
commit 043f73f
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/.github/workflows/build-images-from-branch.yml b/.github/workflows/build-images-from-branch.yml
@@ -153,8 +153,8 @@ jobs:
 
       - name: Remove lines that are always expected to be different
         run: |
-          sed -i '/"uri": "file:\/\/\/github\/workspace\/base\//d' ${{ github.workspace }}/trivy-results-base.sarif
-          sed -i '/"uri": "file:\/\/\/github\/workspace\/branch\//d' ${{ github.workspace }}/trivy-results-branch.sarif
+          jq '.runs |= map(del(.originalUriBaseIds, .properties))' ${{ github.workspace }}/trivy-results-base.sarif > ${{ github.workspace }}/trivy-results-base.sarif
+          jq '.runs |= map(del(.originalUriBaseIds, .properties))' ${{ github.workspace }}/trivy-results-branch.sarif > ${{ github.workspace }}/trivy-results-branch.sarif
 
       - name: Diff Trivy results to catch newly introduced vulnerabilities
         run: diff -u ./trivy-results-base.sarif ./trivy-results-branch.sarif

diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
@@ -84,8 +84,8 @@ jobs:
 
       - name: Remove lines that are always expected to be different
         run: |
-          sed -i '/"uri": "file:\/\/\/home\/runner\/work\/opencrvs-core\/opencrvs-core\/base\/"/d' ./trivy-results-base.sarif
-          sed -i '/"uri": "file:\/\/\/home\/runner\/work\/opencrvs-core\/opencrvs-core\/branch\/"/d' ./trivy-results-branch.sarif
+          jq '.runs |= map(del(.originalUriBaseIds, .properties))' ./trivy-results-base.sarif > ./trivy-results-base.sarif
+          jq '.runs |= map(del(.originalUriBaseIds, .properties))' ./trivy-results-branch.sarif > ./trivy-results-branch.sarif
 
       - name: Diff Trivy results to catch newly introduced vulnerabilities
         run: diff -u ./trivy-results-base.sarif ./trivy-results-branch.sarif