Skip to content

upload-sarif does not handle relative paths when trivy runs on a subfolder #2904

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
rofreytag opened this issue May 23, 2025 · 1 comment
Open

upload-sarif does not handle relative paths when trivy runs on a subfolder #2904

rofreytag opened this issue May 23, 2025 · 1 comment

Comments

@rofreytag
Copy link

Originally posted by @rofreytag in #2215

I run into an issue when using trivy config scan on a subfolder. The reported issues appear in the security tab, but the folder/path reference of files inside the repo is not correctly presented.

Example finding:

Image

The expected path should be terraform/01-bootstrap/eks.tf.

The generated sarif file by trivy:

  • uses URLs relative to terraform/some-module (i.e. main.tf)
  • uses relative URLs for module invocations like ../modules/other-module/main.tf.
  • includes the correct uriBaseId

GitHub interprets all these URls relative to the repo root without using uriBaseId.

I am happy to try a workaround, but currently

  • I can not yet find a way to make trivy generate absolute URLs, which I believe resolves the issue.
  • Neither can I tell the upload-action that I am using relative URLs in my repo

expected behavior

Either have the upload-action use the uriBaseId of the sarif file, or

have an existing param like checkout_path (or a new param) in the action, to respect and transform relative URLs, so that they correctly appear in the report.

Example:

     - name: Upload Trivy scan results to GitHub Security tab
       uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
       with:
         sarif_file: 'trivy-results.sarif'
         category: trivy-my-module
         checkout_path: ${{ github.workspace }}/terraform/01-bootstrap/

Here an excerpt of the generated sarif file that shows the URLs of each finding

          "message": {
            "text": "Artifact: eks.tf\nType: terraform\nVulnerability aws-vpc-add-description-to-security-group-rule\nSeverity: LOW\nMessage: Security group rule does not have a description.\nLink: [aws-vpc-add-description-to-security-group-rule](https://avd.aquasec.com/misconfig/aws-vpc-add-description-to-security-group-rule)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "eks.tf",
                  "uriBaseId": "ROOTPATH"
                },

          "message": {
            "text": "Artifact: ../modules/rdb/main.tf\nType: terraform\nVulnerability AVD-AWS-0098\nSeverity: LOW\nMessage: Secret explicitly uses the default key.\nLink: [AVD-AWS-0098](https://avd.aquasec.com/misconfig/avd-aws-0098)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "../modules/rdb/main.tf",
                  "uriBaseId": "ROOTPATH"
                },

and the originalUriBaseId section at the end:

      "originalUriBaseIds": {
        "ROOTPATH": {
          "uri": "file:///home/runner/work/redacted/redacted/terraform/01-bootstrap/"
        }
      }
    }
  ]
}

Here is my full workflow file

name: Code Scan

on:
  push:
    branches: [ "main" ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "main" ]
  schedule:
    - cron: '27 23 * * 2'

permissions:
  contents: read # for actions/checkout to fetch code
  security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
  actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status

jobs:
  analyze-tf:
    runs-on: ubuntu-latest
    name: Analyze (${{ matrix.config.path }})
    strategy:
      matrix:
        config:
        - path: terraform/00-shared
          varfile: configs/sai-shared-prod.tfvars
        - path: terraform/01-bootstrap
          varfile: configs/sai-prod.tfvars
        - path: terraform/02-k8s
          varfile: configs/sai-prod.tfvars
        - path: terraform/03-services
          varfile: configs/sai-prod.tfvars

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Run Trivy scanner
        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 #v0.30.0
        with:
          scan-type: 'config'
          scan-ref: ${{ matrix.config.path }}
          tf-vars: ${{ matrix.config.path }}/${{ matrix.config.varfile }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'
          version: v0.61.1

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
        with:
          sarif_file: 'trivy-results.sarif'
          # need to add unique category, so the results in one commit do not overwrite each other
          category: trivy-${{ matrix.config.path }}
          # I tried this with no luck
          # checkout_path: ${{ github.workspace }}/${{ matrix.config.path }}/
@rofreytag rofreytag mentioned this issue May 23, 2025
Open
@jketema
Copy link

jketema commented May 23, 2025

Hi @rofreytag,

This is a known limitation. Note also the conspicuous absence of uriBaseId from this document. I've added link to this issue in the internal issue in which we're tracking this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@rofreytag @jketema
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy