david/docker-trivy
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

formatting

Browse Source
This commit is contained in:
David Duran Rosich committed 2026-10-25 11:34:15 +01:00
1 parent 9cabdefdf4
commit 77d064627a
3 files changed
+283 -124
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/test_scan.py
+65 -20
View File
@@ -332,6 +332,22 @@ class SettingsTests(unittest.TestCase):
self.assertIs(scan.env_bool("SOME_FLAG", not expected), expected)
class ShortImageTests(unittest.TestCase):
def test_short_image_truncates_digest_in_reference(self) -> None:
digest = "sha256:" + "a" * 64
self.assertEqual(
scan.short_image(f"ghcr.io/acme/app@{digest}"),
"ghcr.io/acme/app@sha256:aaaaaa",
)
def test_short_image_truncates_bare_digest(self) -> None:
digest = "sha256:" + "b" * 64
self.assertEqual(scan.short_image(digest), "sha256:bbbbbb")
def test_short_image_leaves_tags_unchanged(self) -> None:
self.assertEqual(scan.short_image("nginx:1.27"), "nginx:1.27")
REPORT = {
"Results": [
{
@@ -473,10 +489,9 @@ class ReportTests(unittest.TestCase):
body = scan.build_important_body(
"web", target, result, "/reports/x.json", "HIGH"
)
self.assertIn("Image: nginx:1.27", body)
self.assertIn("Container: web", body)
self.assertIn("C 1/1 H 1/2 M 0/0 L 0/0", body)
self.assertIn("Total: 2/3", body)
self.assertIn("| Image | Container | C | H |", body)
self.assertIn("| nginx:1.27 | web | 1/1 | 1/2 |", body)
self.assertNotIn("| M |", body)
self.assertIn("CVE-1", body)
self.assertIn("CVE-2", body)
self.assertIn("CVE-5", body)
@@ -492,25 +507,52 @@ class ReportTests(unittest.TestCase):
self.assertIn("CVE-1", body)
self.assertNotIn("CVE-2", body)
self.assertNotIn("CVE-5", body)
self.assertIn("C 1/1 H 0/0 M 0/0 L 0/0", body)
self.assertIn("Total: 1/1", body)
self.assertIn("| Image | Container | C |", body)
self.assertIn("| nginx:1.27 | web | 1/1 |", body)
self.assertNotIn("| H |", body)
self.assertNotIn("Total:", body)
def test_build_other_containers_body_has_counts_per_container(self) -> None:
bodies = scan.build_other_containers_bodies(
[
("nginx:1.27", "web-worker", 3, 2, 1, {"CRITICAL":1,"HIGH":2,"MEDIUM":0,"LOW":0}, {"CRITICAL":1,"HIGH":1,"MEDIUM":0,"LOW":0}),
("redis:7", "cache", 4, 0, 4, {"CRITICAL":0,"HIGH":4,"MEDIUM":0,"LOW":0}, {"CRITICAL":0,"HIGH":0,"MEDIUM":0,"LOW":0}),
]
],
scan.severity_rank("HIGH"),
)
body = bodies[0]
self.assertIn("Other containers with findings", body)
self.assertIn("nginx:1.27 [web-worker]", body)
self.assertIn("C 1/1 H 1/2 M 0/0 L 0/0", body)
self.assertIn("Total: 2/3", body)
self.assertIn("redis:7 [cache]", body)
self.assertIn("C 0/0 H 0/4 M 0/0 L 0/0", body)
self.assertIn("Total: 0/4", body)
self.assertIn("Total: 2/7 in 2 container(s)", body)
self.assertIn("| Image | Container | C | H |", body)
self.assertIn("| nginx:1.27 | web-worker | 1/1 | 1/2 |", body)
self.assertIn("| redis:7 | cache | 0/0 | 0/4 |", body)
self.assertNotIn("| M |", body)
self.assertNotIn("Total:", body)
self.assertNotIn("Overall:", body)
def test_build_final_summary_body_lists_packages_and_overall(self) -> None:
result = scan.summarise(REPORT)
target = scan.ScanTarget(image="nginx:1.27", containers=["web"])
aggregated = scan.AggregatedReport()
aggregated.results["nginx:1.27"] = result
all_rows = scan.build_container_rows(
[target],
aggregated,
scan.severity_rank("HIGH"),
include_empty=True,
)
body = scan.build_final_summary_body(
[("web", target, result)], all_rows, "HIGH"
)
self.assertIn("Important containers:", body)
self.assertIn("| Image | Container | C | H |", body)
self.assertIn("| nginx:1.27 | web | 1/1 | 1/2 |", body)
self.assertIn("Packages:", body)
self.assertIn("libc 1.0 -> 1.1", body)
self.assertIn("openssl 3.0.1 -> 3.0.2", body)
self.assertIn("Overall severity: C 1/1 H 1/2", body)
self.assertNotIn("Overall severity: C 1/1 H 1/2 M", body)
self.assertIn("Overall: 2/3 fixable/total in 1 container(s)", body)
self.assertNotIn("Total:", body)
def test_build_missing_body_separates_missing_and_unscanned(self) -> None:
body = scan.build_missing_body(["gone"], ["web"])
@@ -645,8 +687,11 @@ printf '%s\\n' "$*" >> "$APPRISE_LOG"
self.assertEqual(code, 0)
notification = Path(self.apprise_log).read_text()
self.assertIn("Vulnerability scan: web (alpine:3.20)", notification)
self.assertIn("Total: 0/0", notification)
self.assertNotIn("Total:", notification)
self.assertIn("No CVEs at or above", notification)
self.assertIn("Vulnerability scan: summary", notification)
self.assertIn("| alpine:3.20 | web | 0/0 | 0/0 |", notification)
self.assertIn("Overall: 0/0 fixable/total in 1 container(s)", notification)
def test_notification_includes_container(self) -> None:
containers = [container("a" * 64, "testphp-php", name="testphp")]
@@ -671,13 +716,13 @@ printf '%s\\n' "$*" >> "$APPRISE_LOG"
self.assertEqual(code, 1)
notification = Path(self.apprise_log).read_text()
self.assertIn("Vulnerability scan: web (testphp-php)", notification)
self.assertIn("Container: web", notification)
self.assertIn("| testphp-php | web | 1/1 | 0/0 |", notification)
self.assertIn("CVE-2026-0001", notification)
self.assertIn("Vulnerability scan: other containers", notification)
self.assertIn("redis:7 [cache]", notification)
self.assertIn("C 0/0 H 0/1 M 0/0 L 0/0", notification)
self.assertIn("Total: 0/1", notification)
self.assertIn("1/1 (fixable/total)", notification)
self.assertIn("| redis:7 | cache | 1/1 | 0/0 |", notification)
self.assertNotIn("Total:", notification)
self.assertIn("Vulnerability scan: summary", notification)
self.assertIn("Overall: 2/2 fixable/total in 2 container(s)", notification)
# The important container must not also appear in the summary.
self.assertNotIn("testphp-php [web]", notification)