🐛 Trivy scan fails when no critical vulnerabilities are detected

[jacobwoffenden]

Describe the bug.

Our scanning workflow is designed to fail when it detects CRITICAL

https://github.com/ministryofjustice/data-platform/blob/74cd81562d66e5ad0e101cc08adce6cd39e1e142/.github/workflows/reusable-workflow-containers.yml#L183-L191

However it is failing regardless https://github.com/ministryofjustice/data-platform/actions/runs/6786028361/job/18445644387?pr=2227#step:5:15

To Reproduce

1. Push an image with no CRITICAL vulnerabilities

Expected Behaviour

Workflow passes

Additional context

I built the offending image locally and ran it through Trivy and the generated SARIF is as expected

Related: aquasecurity/trivy-action#281

[eugentius]

limit-severities-for-sarif: true fixes the issue

limit-severities-for-sarif: true
trivy  image <image-with-no-critical-vuln> --exit-code  1 --ignore-unfixed --vuln-type  os,library --severity CRITICAL; echo $?
0

limit-severities-for-sarif: false
trivy  image <image-with-no-critical-vuln> --exit-code  1 --ignore-unfixed --vuln-type  os,library ; echo $? 
1

[jacobwoffenden]

Thanks @eugentius!