Skip to content

Conversation

@DmitriyLewen
Copy link
Contributor

Description

This PR fixes an inconsistency where local FS Artifact.Inspect() returned an artifact.Reference without RepoMetadata on cache hits. As a result, repository context (repo URL, branch, tags, commit, author, etc.) was lost when the result came
from cache, diverging from the non-cached path.

Changes:

  • Populate RepoMetadata from a.repoMetadata in the cache-hit path of pkg/fanal/artifact/local/fs.go.
  • Update pkg/fanal/artifact/repo/git_test.go to assert RepoMetadata fields (RepoURL, Branch, Tags, Commit, CommitMsg, Author, Committer).

Examples:

Before:

➜ trivy repo -f json -o repo.test --cache-dir .cache --scanners=secret -q https://github.com/test/repo/
➜ jq '.Metadata.RepoURL' repo.test    
"https://github.com/test/repo/"


➜ trivy repo -f json -o repo.test --cache-dir .cache --scanners=secret -q https://github.com/test/repo/
➜ jq '.Metadata.RepoURL' repo.test    
null

After:

➜ trivy repo -f json -o repo.test --cache-dir .cache --scanners=secret -q https://github.com/test/repo/
➜ jq '.Metadata.RepoURL' repo.test    
"https://github.com/test/repo/"


➜ trivy repo -f json -o repo.test --cache-dir .cache --scanners=secret -q https://github.com/test/repo/
➜ jq '.Metadata.RepoURL' repo.test    
"https://github.com/test/repo/"

Related issues

Related PRs

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@DmitriyLewen DmitriyLewen changed the title fix(artifact): preserve RepoMetadata on FS cache hit fix(repo): preserve RepoMetadata on FS cache hit Aug 27, 2025
@DmitriyLewen DmitriyLewen self-assigned this Aug 27, 2025
@DmitriyLewen DmitriyLewen added the autoready Automatically mark PR as ready for review when all checks pass label Aug 27, 2025
@DmitriyLewen DmitriyLewen marked this pull request as ready for review August 27, 2025 09:29
@DmitriyLewen DmitriyLewen requested a review from knqyf263 as a code owner August 27, 2025 09:29
@DmitriyLewen DmitriyLewen removed the autoready Automatically mark PR as ready for review when all checks pass label Aug 27, 2025
@DmitriyLewen DmitriyLewen added this pull request to the merge queue Aug 27, 2025
Merged via the queue into aquasecurity:main with commit 4f2a44e Aug 27, 2025
13 of 14 checks passed
@DmitriyLewen DmitriyLewen deleted the fix/repo/missed-metadata-after-cache branch August 27, 2025 11:30
alexlebens pushed a commit to alexlebens/infrastructure that referenced this pull request Sep 3, 2025
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.65.0` -> `0.66.0` |

---

### Release Notes

<details>
<summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary>

### [`v0.66.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0660-2025-09-02)

[Compare Source](aquasecurity/trivy@v0.65.0...v0.66.0)

##### Features

- add timeout handling for cache database operations ([#&#8203;9307](aquasecurity/trivy#9307)) ([235c24e](aquasecurity/trivy@235c24e))
- **misconf:** added audit config attribute ([#&#8203;9249](aquasecurity/trivy#9249)) ([4d4a244](aquasecurity/trivy@4d4a244))
- **secret:** implement streaming secret scanner with byte offset tracking ([#&#8203;9264](aquasecurity/trivy#9264)) ([5a5e097](aquasecurity/trivy@5a5e097))
- **terraform:** use .terraform cache for remote modules in plan scanning ([#&#8203;9277](aquasecurity/trivy#9277)) ([298a994](aquasecurity/trivy@298a994))

##### Bug Fixes

- **conda:** memory leak by adding closure method for `package.json` file ([#&#8203;9349](aquasecurity/trivy#9349)) ([03d039f](aquasecurity/trivy@03d039f))
- create temp file under composite fs dir ([#&#8203;9387](aquasecurity/trivy#9387)) ([ce22f54](aquasecurity/trivy@ce22f54))
- **cyclonedx:** handle multiple license types ([#&#8203;9378](aquasecurity/trivy#9378)) ([46ab76a](aquasecurity/trivy@46ab76a))
- **fs:** avoid shadowing errors in file.glob ([#&#8203;9286](aquasecurity/trivy#9286)) ([b51c789](aquasecurity/trivy@b51c789))
- **image:** use standardized HTTP client for ECR authentication ([#&#8203;9322](aquasecurity/trivy#9322)) ([84fbf86](aquasecurity/trivy@84fbf86))
- **misconf:** ensure ignore rules respect subdirectory chart paths ([#&#8203;9324](aquasecurity/trivy#9324)) ([d3cd101](aquasecurity/trivy@d3cd101))
- **misconf:** ensure module source is known ([#&#8203;9404](aquasecurity/trivy#9404)) ([81d9425](aquasecurity/trivy@81d9425))
- **misconf:** preserve original paths of remote submodules from .terraform ([#&#8203;9294](aquasecurity/trivy#9294)) ([1319d8d](aquasecurity/trivy@1319d8d))
- **misconf:** use correct field log\_bucket instead of target\_bucket in gcp bucket ([#&#8203;9296](aquasecurity/trivy#9296)) ([04ad0c4](aquasecurity/trivy@04ad0c4))
- persistent flag option typo ([#&#8203;9374](aquasecurity/trivy#9374)) ([6e99dd3](aquasecurity/trivy@6e99dd3))
- **plugin:** don't remove plugins when updating index.yaml file ([#&#8203;9358](aquasecurity/trivy#9358)) ([5f067ac](aquasecurity/trivy@5f067ac))
- **python:** impove package name normalization  ([#&#8203;9290](aquasecurity/trivy#9290)) ([1473e88](aquasecurity/trivy@1473e88))
- **repo:** preserve RepoMetadata on FS cache hit ([#&#8203;9389](aquasecurity/trivy#9389)) ([4f2a44e](aquasecurity/trivy@4f2a44e))
- **repo:** sanitize git repo URL before inserting into report metadata ([#&#8203;9391](aquasecurity/trivy#9391)) ([1ac9b1f](aquasecurity/trivy@1ac9b1f))
- **sbom:** add support for `file` component type of `CycloneDX` ([#&#8203;9372](aquasecurity/trivy#9372)) ([aa7cf43](aquasecurity/trivy@aa7cf43))
- suppress debug log for context cancellation errors ([#&#8203;9298](aquasecurity/trivy#9298)) ([2458d5e](aquasecurity/trivy@2458d5e))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4zNS4xIiwidXBkYXRlZEluVmVyIjoiNDEuMzUuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1367
Co-authored-by: Renovate Bot <[email protected]>
Co-committed-by: Renovate Bot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug(repo): Trivy doesn't show repository metadata if the scan cache contains this scan.

2 participants