From 7d2c159fbbc4e4cc7615905d5c43040c1b356b8d Mon Sep 17 00:00:00 2001 From: Adva Oren Date: Wed, 22 Jul 2026 20:36:00 +0300 Subject: [PATCH 1/3] feat(report): add remediation and recommendation details to pipeline summary The Tekton task console output now surfaces trusted-content remediations and recommendations that were previously only available in the JSON report. Co-Authored-By: Claude Opus 4.6 (1M context) --- docker-image/scripts/trustify-da.sh | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/docker-image/scripts/trustify-da.sh b/docker-image/scripts/trustify-da.sh index 6792e84b..b1ed2461 100644 --- a/docker-image/scripts/trustify-da.sh +++ b/docker-image/scripts/trustify-da.sh @@ -103,6 +103,34 @@ for provider in $providers; do printf " High : %s \n" "$(jq -r --arg provider "$provider" --arg source "$source" '.providers[$provider].sources[$source].summary.high' <<< $report)" printf " Medium : %s \n" "$(jq -r --arg provider "$provider" --arg source "$source" '.providers[$provider].sources[$source].summary.medium' <<< $report)" printf " Low : %s \n" "$(jq -r --arg provider "$provider" --arg source "$source" '.providers[$provider].sources[$source].summary.low' <<< $report)" + remediations_count=$(jq -r --arg provider "$provider" --arg source "$source" '.providers[$provider].sources[$source].summary.remediations' <<< $report) + printf " Remediations : %s \n" "$remediations_count" + if [ "$remediations_count" -gt 0 ] 2>/dev/null; then + jq -r --arg provider "$provider" --arg source "$source" ' + [.providers[$provider].sources[$source].dependencies[] | + . as $dep | + [(.issues // [])[] | select(.remediation.trustedContent.ref != null) | + {ref: $dep.ref, tc: .remediation.trustedContent.ref, cves: ((.cves // [.id]) | join(", "))} + ] + [(.transitive // [])[] | . as $t | + (.issues // [])[] | select(.remediation.trustedContent.ref != null) | + {ref: $t.ref, tc: .remediation.trustedContent.ref, cves: ((.cves // [.id]) | join(", "))} + ] + ] | flatten | unique_by(.ref + .tc) | .[] | + " \(.ref)\n → \(.tc)\n CVEs: \(.cves)" + ' <<< "$report" + fi + done + + rec_sources=$(jq -r --arg provider "$provider" '.providers[$provider].recommendations // {} | keys[]' <<< "$report" 2>/dev/null) + for rec_source in $rec_sources; do + rec_total=$(jq -r --arg provider "$provider" --arg rs "$rec_source" '.providers[$provider].recommendations[$rs].summary.total // 0' <<< "$report") + printf " Recommendations (%s): %s\n" "$rec_source" "$rec_total" + if [ "$rec_total" -gt 0 ] 2>/dev/null; then + jq -r --arg provider "$provider" --arg rs "$rec_source" ' + .providers[$provider].recommendations[$rs].dependencies[]? | + " \(.ref)\n → \(.recommendation)" + ' <<< "$report" + fi done fi done From da4dc83e9a6e1b43a05eb95ad4adf0a75bc990bc Mon Sep 17 00:00:00 2001 From: Adva Oren Date: Wed, 22 Jul 2026 21:38:45 +0300 Subject: [PATCH 2/3] fix(report): handle source names with spaces in pipeline summary Use `while IFS= read -r` instead of `for ... in` to iterate over source names, preventing names like "Red Hat Product Security" from being split on whitespace. Co-Authored-By: Claude Opus 4.6 (1M context) --- docker-image/scripts/trustify-da.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-image/scripts/trustify-da.sh b/docker-image/scripts/trustify-da.sh index b1ed2461..6e57d7c1 100644 --- a/docker-image/scripts/trustify-da.sh +++ b/docker-image/scripts/trustify-da.sh @@ -93,7 +93,7 @@ for provider in $providers; do code=$(echo $provider_status | jq -r '.code') if [ "$code" -eq 200 ]; then sources=$(jq -r --arg provider "$provider" '.providers[$provider].sources | keys[]' <<< "$report") - for source in $sources; do + while IFS= read -r source; do printf " Source: %s\n" "${source^}" printf " Vulnerabilities\n" printf " Total : %s \n" "$(jq -r --arg provider "$provider" --arg source "$source" '.providers[$provider].sources[$source].summary.total' <<< $report)" @@ -119,7 +119,7 @@ for provider in $providers; do " \(.ref)\n → \(.tc)\n CVEs: \(.cves)" ' <<< "$report" fi - done + done <<< "$sources" rec_sources=$(jq -r --arg provider "$provider" '.providers[$provider].recommendations // {} | keys[]' <<< "$report" 2>/dev/null) for rec_source in $rec_sources; do From 1f2ef75c60b0e29e40c829cff96b3217b52e66bb Mon Sep 17 00:00:00 2001 From: Adva Oren Date: Thu, 30 Jul 2026 18:47:19 +0300 Subject: [PATCH 3/3] fix(report): use safe iteration and composite key in pipeline summary Use while IFS= read -r for recommendation source iteration to handle names with spaces, and use unique_by({ref, tc}) to avoid key collisions from string concatenation. Co-Authored-By: Claude Opus 4.6 (1M context) --- docker-image/scripts/trustify-da.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docker-image/scripts/trustify-da.sh b/docker-image/scripts/trustify-da.sh index 6e57d7c1..2e9d9dd4 100644 --- a/docker-image/scripts/trustify-da.sh +++ b/docker-image/scripts/trustify-da.sh @@ -115,14 +115,14 @@ for provider in $providers; do (.issues // [])[] | select(.remediation.trustedContent.ref != null) | {ref: $t.ref, tc: .remediation.trustedContent.ref, cves: ((.cves // [.id]) | join(", "))} ] - ] | flatten | unique_by(.ref + .tc) | .[] | + ] | flatten | unique_by({ref, tc}) | .[] | " \(.ref)\n → \(.tc)\n CVEs: \(.cves)" ' <<< "$report" fi done <<< "$sources" rec_sources=$(jq -r --arg provider "$provider" '.providers[$provider].recommendations // {} | keys[]' <<< "$report" 2>/dev/null) - for rec_source in $rec_sources; do + while IFS= read -r rec_source; do rec_total=$(jq -r --arg provider "$provider" --arg rs "$rec_source" '.providers[$provider].recommendations[$rs].summary.total // 0' <<< "$report") printf " Recommendations (%s): %s\n" "$rec_source" "$rec_total" if [ "$rec_total" -gt 0 ] 2>/dev/null; then @@ -131,7 +131,7 @@ for provider in $providers; do " \(.ref)\n → \(.recommendation)" ' <<< "$report" fi - done + done <<< "$rec_sources" fi done printf "=%.0s" {1..50}