Uploading sarif files: instance.runs[0].tool.driver.rules contains duplicate item

Hi guys,

Hope you are all well !

I tried trivy action and I have the following error:

Uploading sarif files: ["trivy-results.sarif"]
Error details: instance.runs[0].tool.driver.rules contains duplicate item

Is there a parameter to set in trivy to avoid duplicates ?

Here is my workflow file:
https://github.com/lucmichalski/prestashop-docker/blob/trivy/.github/workflows/security.yml

Cheers,
Luc Michalski

[simar7]

hi @lucmichalski - I'd like to repro this, is the image you were running this against public? Also would it be possible for you to share the generated SARIF output?

You can do so by running trivy as:

trivy image --format=template --template="@contrib/sarif.tpl" <imageName>

You can find a copy of sarif.tpl here: https://github.com/aquasecurity/trivy/blob/master/contrib/sarif.tpl

[beevelop]

Experiencing the same issue with an image scan for Docker-Android:

Run github/codeql-action/upload-sarif@v1
  with:
    sarif_file: trivy-results.sarif
    checkout_path: /home/runner/work/docker-android/docker-android
    token: ***
    matrix: null
  env:
    platforms: linux/amd64
    imageName: ***/android
Uploading sarif files: ["trivy-results.sarif"]
Error details: instance.runs[0].tool.driver.rules contains duplicate item
Error: Unable to upload "trivy-results.sarif" as it is not valid SARIF:
- instance.runs[0].tool.driver.rules contains duplicate item
Error: Unable to upload "trivy-results.sarif" as it is not valid SARIF:
- instance.runs[0].tool.driver.rules contains duplicate item
    at validateSarifFileSchema (/home/runner/work/_actions/github/codeql-action/v1/lib/upload-lib.js:142:15)
    at uploadFiles (/home/runner/work/_actions/github/codeql-action/v1/lib/upload-lib.js:201:9)
    at Object.uploadFromActions (/home/runner/work/_actions/github/codeql-action/v1/lib/upload-lib.js:91:18)
    at processTicksAndRejections (internal/process/task_queues.js:93:5)
    at async run (/home/runner/work/_actions/github/codeql-action/v1/lib/upload-sarif-action.js:34:29)
    at async runWrapper (/home/runner/work/_actions/github/codeql-action/v1/lib/upload-sarif-action.js:46:9)

Build: https://github.com/beevelop/docker-android/pull/29/checks?check_run_id=1891411385

[simar7]

@rahul2393 - can you take a look into this?

[rahul2393]

The issue is happening because of duplicate ruleID, I am creating patch to append Package Name too in ID

[rahul2393]

@simar7 help review PR

[simar7]

@lucmichalski aquasecurity/trivy#913 was merged and the next release of Trivy/TrivyAction will support it.

[beevelop]

Thank you both 🙏

[jsjoeio]

Is this fix in the latest release of TrivyAction?

[simar7]

Is this fix in the latest release of TrivyAction?

Trivy Action uses the latest released version of Trivy https://github.com/aquasecurity/trivy-action/blob/master/Dockerfile#L1

Trivy recently had a new release which includes this fix so by the virtue of that the new Trivy Action will also have it.