Add pr-comment option to post scan results on pull requests#714
Open
David-Uka wants to merge 1 commit into
Open
Add pr-comment option to post scan results on pull requests#714David-Uka wants to merge 1 commit into
David-Uka wants to merge 1 commit into
Conversation
Resolves anchore#162. Adds a 'pr-comment' input (default false) and a 'github-token' input. When enabled on a pull_request event, the action parses the Grype SARIF report and posts a summary comment (per-severity counts plus a collapsible table of findings) on the triggering PR. A hidden marker is used to update a single comment across runs instead of posting a new one each time. Per maintainer guidance on the issue, this is built into the main action as an option rather than a separate sub-action. Commenting is best-effort: any failure is logged as a warning and never fails the scan. When output-format is not sarif, an additional SARIF file is emitted solely to render the comment, leaving the user's chosen output untouched. PR comments are created/updated via the GitHub REST API using the built-in fetch, avoiding a new runtime dependency in the bundled action. Signed-off-by: UKA David Ikechukwu <155882429+David-Uka@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #162.
Adds an option to post the Grype scan results as a comment on the pull request that triggered the workflow, as requested in #162. Per the maintainer guidance on that issue, this is built into the main action as an option rather than a separate sub-action.
What it does
pr-commentinput (defaultfalse) andgithub-tokeninput.pr-comment: trueon apull_requestevent, the action reads the SARIF report it already produces, and posts a summary comment: a per-severity count plus a table of findings (severity, package, version, fix, linked advisory).<!-- anchore/scan-action pr-comment -->) is used to find and update a single comment across runs, instead of posting a new comment on every push.Notes
fetchagainst the GitHub REST API.grypeis invoked. It requiresoutput-format: sarif(the default) and warns + skips otherwise.pull-requests: writepermission on the token.Testing
tests/pr_comment.test.jscovering SARIF parsing, comment rendering (counts/sorting/links/empty), and the create-vs-update / skip paths (mocked API).dist/rebuilt.