From e61545e1f1282f33530942482fecd202e0864440 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Str=C3=B6mberg?= <t+github@chainguard.dev>
Date: Wed, 6 Nov 2024 07:50:42 -0500
Subject: [PATCH] Allow --err-first-miss to continue for skipped files (#591)

---
 pkg/action/scan.go | 59 +++++++++++++++++++++++++++++-----------------
 1 file changed, 37 insertions(+), 22 deletions(-)

diff --git a/pkg/action/scan.go b/pkg/action/scan.go
index 4224a0a7..dcade5e6 100644
--- a/pkg/action/scan.go
+++ b/pkg/action/scan.go
@@ -154,34 +154,49 @@ func errIfHitOrMiss(frs *sync.Map, kind string, scanPath string, errIfHit bool,
 		count  int
 		suffix string
 	)
-	if frs != nil {
-		frs.Range(func(_, value any) bool {
-			if value == nil {
+	if frs == nil {
+		return nil
+	}
+
+	filesScanned := 0
+
+	frs.Range(func(_, value any) bool {
+		if value == nil {
+			return true
+		}
+		if fr, ok := value.(*malcontent.FileReport); ok {
+			if fr.Skipped != "" {
 				return true
 			}
-			if fr, ok := value.(*malcontent.FileReport); ok {
-				for _, b := range fr.Behaviors {
-					count++
-					bMap.Store(b.ID, true)
-				}
-			}
-			return true
-		})
-
-		bMap.Range(func(key, _ any) bool {
-			if key == nil {
+			if fr.Error != "" {
 				return true
 			}
-			if k, ok := key.(string); ok {
-				bList = append(bList, k)
+			filesScanned++
+			for _, b := range fr.Behaviors {
+				count++
+				bMap.Store(b.ID, true)
 			}
-			return true
-		})
-		sort.Strings(bList)
+		}
+		return true
+	})
 
-		if len(bList) > 0 {
-			suffix = fmt.Sprintf(": %s", strings.Join(bList, " "))
+	bMap.Range(func(key, _ any) bool {
+		if key == nil {
+			return true
 		}
+		if k, ok := key.(string); ok {
+			bList = append(bList, k)
+		}
+		return true
+	})
+	sort.Strings(bList)
+
+	if len(bList) > 0 {
+		suffix = fmt.Sprintf(": %s", strings.Join(bList, " "))
+	}
+
+	if filesScanned == 0 {
+		return nil
 	}
 
 	// Behavioral note: this logic is per-archive or per-file, depending on context
@@ -190,7 +205,7 @@ func errIfHitOrMiss(frs *sync.Map, kind string, scanPath string, errIfHit bool,
 	}
 
 	if errIfMiss && count == 0 {
-		return fmt.Errorf("no matching capabilities in %s %s%s", scanPath, kind, suffix)
+		return fmt.Errorf("no matching capabilities in %q kind=%s suffix=%s", scanPath, kind, suffix)
 	}
 	return nil
 }