feat(trivy): Bump to support v0.56.1

[simar7]

No description provided.

[simar7]

@nikpivkin any idea why the tests are red in the CI? Locally I don't see any failures.

 BATS_LIB_PATH=/opt/homebrew/lib TRIVY_DISABLE_VEX_NOTICE=true bats -r -T .
./test/test.bats
 ✓ trivy repo with securityCheck secret only [1000]
 ✓ trivy image [1000]
 ✓ trivy config sarif report [1000]
 ✓ trivy config [1000]
 ✓ trivy rootfs [1000]
 ✓ trivy fs [1000]
 ✓ trivy image with trivyIgnores option [1000]
 ✓ trivy image with sbom output [1000]
 ✓ trivy image with trivy.yaml config [1000]
 ✓ trivy image with custom docker-host [1000]
 ✓ trivy config with terraform variables [1000]

11 tests, 0 failures in 12 seconds

[nikpivkin]

@simar7 The tests use the trivy-checks bundle snapshot stored in this repository, but running the tests locally uses checks from the Trivy cache, so the test result is different. I will open a separate PR with an update to the Makefile to make the local test run consistent with CI.

This is the difference in local run on the main branch:

✗ trivy config sarif report [607]
   (from function `assert_files_equal' in file /opt/homebrew/lib/bats-file/src/file.bash, line 266,
    from function `compare_files' in file ./test/test.bats, line 54,
    in test file ./test/test.bats, line 72)
     `compare_files config-sarif.sarif ./test/data/config-sarif-report/report.sarif' failed
   Building SARIF report with options:  ./test/data/config-sarif-report/main.tf
   3c3
   <   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
   ---
   >   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   3c3
   <   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
   ---
   >   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   
   -- files are not the same --
   path : config-sarif.sarif
   path : ./test/data/config-sarif-report/report.sarif
   --

[simar7]

@nikpivkin I've updated the PR to Trivy v0.56.0, when it is released we can merge this one in.

[simar7]

@nikpivkin could you take another look?

[simar7]

does this make sense to you @nikpivkin? I understand that the Go rule was deprecated but should the Rego rule in it's place still pick this up?

[nikpivkin]

@simar7 We need to update the checks bundle since Trivy now uses version 1. Can you run this workflow? I don't have permission to do that. But before that, we need to update this workflow to pull the first version. I'll open the PR.

[nikpivkin]

@simar7 #398

[simar7]

@simar7 #398

I already did 066a168 and ran that locally to generate the bats test outputs. Does it look the same for you?

[nikpivkin]

The tests use checks bundle from here and it is not updated

[eliflores]

Refs #400