feat: allow findings to be ignored

[jamestelfer]

This PR seeks to introduce an "ignore" file for the plugin, allowing findings for vulnerabilities to be ignored (but not removed).

Note

While this is a commit-by-commit PR, I've left some earlier commits that included a more complicated YAML document schema where ignore items supported simple string entries as well as structured ones. I removed this after feedback from @tomwwright, and kept the commits to document the decision somewhat, but also to keep this implementation archived as a possible future reference.

An ignore file is a YAML file that has the following structure:

ignores:
  - id: CVE-2023-100
  - id: CVE-2023-200
    until: 2023-12-31
    reason: allowing 2 weeks for base image to update
  - id: CVE-2023-300

This structure allows for findings to be ignored for a period of time, giving a team time to respond while allowing builds to continue.

Ignore configuration can be specified in a number of places, from least to most important:

• /etc/ecr-scan-results-buildkite-plugin/ignore.y[a]ml
• buildkite/ecr-scan-results-ignore.y[a]ml
• .buildkite/ecr-scan-results-ignore.y[a]ml
• .ecr-scan-results-ignore.y[a]ml

Configuration in the /etc/ecr-scan-results-buildkite-plugin allows for organizations to ship agents with plugin configuration that centrally manages findings that can be ignored. If a listing for a finding with the same CVE name appears in multiple files, the most local wins: central configuration can be overridden by the repository.

When a finding is ignored, it is removed from consideration for threshold checks, but it's not discarded. The annotation created by the plugin annotates the results with further information instead.

The summary counts at the top show the number of ignored findings:

Ignored findings are separated from the main list and shown at the bottom:

If a reason for ignoring a finding is provided, it's made available by expanding the Until date:

Fixes #24

[therealvio]

I have taken my first stab. The feedback I have is pretty simple, as I try to build a mental model of how it all works.

[ctgardner]

nit: usually, this logic is inverted

Suggested change

	counts := SeverityCount{}
	if c, exists := s.Counts[severity]; exists {
	counts = c
	}
	c := SeverityCount{}
	if counts, exists := s.Counts[severity]; !exists {
	counts = c
	}

[jamestelfer]

The variables defined as a part of the assignment in the if clause (if counts, exists := ) are only in scope in the body of the if, so inverting as suggested won't compile.

The error is counts declared and not used.

[jamestelfer]

I've changed this to:

counts := s.Counts[severity]

Since the default value is returned if the key is not in the map, which is what I'm after.

[ctgardner]

lgtm

[jamestelfer]

☝️ I've really appreciated all the thoughtful review comments, they've definitely improved the implementation, and I've learned through it too 🙏