Add image to list on critical CVE detection

Author: seunghun1ee

tools/scan-images.sh

@@ -27,11 +27,13 @@ docker image ls --filter "reference=ark.stackhpc.com/stackhpc-dev/$1-*:$2" > $1-
 images=$(grep --invert-match --no-filename ^REPOSITORY $1-scanned-container-images.txt | sed 's/ \+/:/g' | cut -f 1,2 -d:)
 
 # Ensure output files exist
-touch image-scan-output/clean-images.txt image-scan-output/dirty-images.txt
+touch image-scan-output/clean-images.txt image-scan-output/dirty-images.txt image-scan-output/critical-images.txt
 
 # If Trivy detects no vulnerabilities, add the image name to clean-images.txt.
 # If there are vulnerabilities detected, add it to dirty-images.txt and
 # generate a csv summary
+# If the image contains at least one critical vulnerabilities, add it to
+# critical-images.txt
 for image in $images; do
   filename=$(basename $image | sed 's/:/\./g')
   if $(trivy image \
@@ -51,13 +53,13 @@ for image in $images; do
   else
     # Add the image to the dirty list
     echo "${image}" >> image-scan-output/dirty-images.txt
-    
+
     # Write a header for the summary CSV
     echo '"PkgName","PkgPath","PkgID","VulnerabilityID","FixedVersion","PrimaryURL","Severity"' > image-scan-output/${filename}.summary.csv
 
     # Write the summary CSV data
-    jq -r '.Results[] 
-            | select(.Vulnerabilities) 
+    jq -r '.Results[]
+            | select(.Vulnerabilities)
             | .Vulnerabilities
             # Ignore packages with "kernel" in the PkgName
             | map(select(.PkgName | test("kernel") | not ))
@@ -72,8 +74,13 @@ for image in $images; do
                     .[0].PrimaryURL,
                     .[0].Severity
                     ]
-                ) 
-            | .[] 
+                )
+            | .[]
             | @csv' image-scan-output/${filename}.json >> image-scan-output/${filename}.summary.csv
+
+    if [ $(grep "CRITICAL" image-scan-output/${filename}.summary.csv -c) -gt 0 ]; then
+      # If the image contains critical vulnerabilities, add the image to critical list
+      echo "${image}" >> image-scan-output/critical-images.txt
+    fi
   fi
 done