fix: harden Trivy integration (scanners, UTF-8 truncate, security findings) - #87
Open
Abhinesh Jha (Abhineshhh) wants to merge 4 commits into
Open
fix: harden Trivy integration (scanners, UTF-8 truncate, security findings)#87Abhinesh Jha (Abhineshhh) wants to merge 4 commits into
Abhinesh Jha (Abhineshhh) wants to merge 4 commits into
Conversation
Trivy renamed --security-checks to --scanners and deprecates the config scanner name in favor of misconfig. Switch RunTrivy to the supported flags so comprehensive scans keep working when the alias is removed. Fixes microsoft#78
Byte-based slicing in truncateString could cut multi-byte characters mid-rune (CJK, emoji), producing invalid UTF-8 stored in the database and emitted in JSON reports. Truncate by rune while respecting a max byte budget (including ...), and add regression tests for multi-byte inputs. Fixes microsoft#79
Comprehensive scans counted secrets/misconfigurations but never built SecurityFindings, so the security_findings table stayed empty and detail reports could not surface them. Map Trivy secrets and misconfigs into domain findings, store them on the image record, load them (and capabilities) in QueryAllImageDetails, and emit them in the detailed JSON report. Fixes microsoft#73
Replace non-ASCII literals in truncate tests with \u escapes (accented Latin and emoji) so the suite is encoding-stable and language-neutral.
Abhinesh Jha (Abhineshhh)
requested review from
Dariusz Porowski (DariuszPorowski) and
Mani Bindra (maniSbindra)
as code owners
July 16, 2026 20:06
This was referenced Jul 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Consolidated Trivy-related fixes that all touch
pkg/infrastructure/scanner/trivy.go, stacked into one PR to avoid merge conflicts and review thrash.Related Issues
Fixes #78
Fixes #79
Fixes #73
Changes
--scannersflag — replace deprecated--security-checks; usemisconfiginstead ofconfig([Bug]: Trivy invoked with deprecated --security-checks flag #78)truncateString— never cut mid-rune; multi-byte regression tests use ASCII-safe\uescapes ([Bug]: truncateString can produce invalid UTF-8 in vulnerability descriptions #79)SecurityFindings, store in DB, load inQueryAllImageDetails, emit in detailed JSON ([Bug]: Comprehensive Trivy findings are counted but never persisted to security_findings #73)Stack note
This replaces the overlapping single-file PRs #80, #81, and #86 (closed in favor of this consolidated stack).
Checklist
go test ./...passes locallydocs/detailed-report.md)