Upload GitHub Dependency Snapshot been skipped when passing exit-code parameter

[abriko]

Workflow settings:

---
name: Pull Request
on:
  push:
    branches:
    - master

## GITHUB_TOKEN authentication, add only if you're not going to use a PAT
permissions:
  contents: write

jobs:
  build:
    name: Checks
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
        uses: aquasecurity/trivy-action@master
        with:
          format: 'github'
          output: 'dependency-results.sbom.json'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'
          image-ref: ${{ env.IMAGE_NAME }}
          github-pat: ${{ secrets.GITHUB_TOKEN }}

If remove exit-code: '1' we can see upload successfully.

[abriko]

Try enhanced #233

[simar7]

Sorry but I don't understand what's the motivation and the desired goal here. Could you help me to better understand what you are looking to achieve?

[abriko]

Hey @simar7

Problem is when pass exit-code and turn on upload result to Dependency Graph, if exit-code is non-zero the entrypoint.sh will fail, and will never upload result. because the script turn on exit when fail in beginning.

My idea is to temporarily turn off script fail when executing scan, to ensure upload successfully.

[simar7]

Got it. Thanks for explaining. But will this change now result in a workflow that will pass rather than fail (as non zero exit code)?

Trivy action should fail if there's a problem, either vulnerability, misconfig, etc. But what you have said is also a legitimate request that I think we should handle differently, rather than passing the workflow.

Thoughts?

[abriko]

Hey @simar7

My enhancement just temporarily disable script fail, in final of script will exit with trivy return code. this part is already covered in original design.
You can see here and here.

So the workflow will still fail if you have some findings.

[simar7]

I see, I understand now. Thanks for explaining.

[simar7]

Closed with #233