feature for better code integration as library

pkg/commands/artifact/config.go

@@ -1,10 +1,13 @@
 package artifact
 
 import (
+	"context"
+
 	"github.com/urfave/cli/v2"
 	"golang.org/x/xerrors"
 
 	"github.com/aquasecurity/fanal/analyzer"
+	pkgReport "github.com/aquasecurity/trivy/pkg/report"
 	"github.com/aquasecurity/trivy/pkg/types"
 )
 
@@ -28,3 +31,19 @@ func ConfigRun(ctx *cli.Context) error {
 	// Run filesystem command internally
 	return Run(ctx.Context, opt, filesystemScanner, initFSCache)
 }
+
+func ConfigRunLib(ctx context.Context, opt Option) (pkgReport.Report, error) {
+
+	// Disable OS and language analyzers
+	opt.DisabledAnalyzers = append(analyzer.TypeOSes, analyzer.TypeLanguages...)
+
+	// Scan only config files
+	opt.VulnType = nil
+	opt.SecurityChecks = []string{types.SecurityCheckConfig}
+
+	// Skip downloading vulnerability DB
+	opt.SkipDBUpdate = true
+
+	// Run filesystem command internally
+	return RunLib(ctx, opt, filesystemScanner, initFSCache)
+}

pkg/commands/artifact/fs.go

@@ -11,6 +11,7 @@ import (
 	"github.com/aquasecurity/fanal/analyzer/config"
 	"github.com/aquasecurity/fanal/artifact"
 	"github.com/aquasecurity/fanal/cache"
+	pkgReport "github.com/aquasecurity/trivy/pkg/report"
 	"github.com/aquasecurity/trivy/pkg/scanner"
 )
 
@@ -36,6 +37,14 @@ func FilesystemRun(ctx *cli.Context) error {
 	return Run(ctx.Context, opt, filesystemScanner, initFSCache)
 }
 
+func FilesystemRunLib(ctx context.Context, opt Option) (pkgReport.Report, error) {
+
+	// Disable the individual package scanning
+	opt.DisabledAnalyzers = analyzer.TypeIndividualPkgs
+
+	return RunLib(ctx, opt, filesystemScanner, initFSCache)
+}
+
 // RootfsRun runs scan on rootfs.
 func RootfsRun(ctx *cli.Context) error {
 	opt, err := initOption(ctx)
@@ -48,3 +57,11 @@ func RootfsRun(ctx *cli.Context) error {
 
 	return Run(ctx.Context, opt, filesystemScanner, initFSCache)
 }
+
+func RootfsRunLib(ctx context.Context, opt Option) (pkgReport.Report, error) {
+
+	// Disable the lock file scanning
+	opt.DisabledAnalyzers = analyzer.TypeLockfiles
+
+	return RunLib(ctx, opt, filesystemScanner, initFSCache)
+}

pkg/commands/artifact/image.go

@@ -11,6 +11,7 @@ import (
 	"github.com/aquasecurity/fanal/analyzer/config"
 	"github.com/aquasecurity/fanal/artifact"
 	"github.com/aquasecurity/fanal/cache"
+	pkgReport "github.com/aquasecurity/trivy/pkg/report"
 	"github.com/aquasecurity/trivy/pkg/scanner"
 )
 
@@ -49,3 +50,17 @@ func ImageRun(ctx *cli.Context) error {
 
 	return Run(ctx.Context, opt, dockerScanner, initFSCache)
 }
+
+// ImageRunLib use trivy as a library
+func ImageRunLib(ctx context.Context, opt Option) (pkgReport.Report, error) {
+
+	// Disable the lock file scanning
+	opt.DisabledAnalyzers = analyzer.TypeLockfiles
+
+	if opt.Input != "" {
+		// scan tar file
+		return RunLib(ctx, opt, archiveScanner, initFSCache)
+	}
+
+	return RunLib(ctx, opt, dockerScanner, initFSCache)
+}

pkg/commands/artifact/repository.go

@@ -11,6 +11,7 @@ import (
 	"github.com/aquasecurity/fanal/analyzer/config"
 	"github.com/aquasecurity/fanal/artifact"
 	"github.com/aquasecurity/fanal/cache"
+	pkgReport "github.com/aquasecurity/trivy/pkg/report"
 	"github.com/aquasecurity/trivy/pkg/scanner"
 	"github.com/aquasecurity/trivy/pkg/types"
 )
@@ -39,3 +40,14 @@ func RepositoryRun(ctx *cli.Context) error {
 
 	return Run(ctx.Context, opt, repositoryScanner, initFSCache)
 }
+
+func RepositoryRunLib(ctx context.Context, opt Option) (pkgReport.Report, error) {
+
+	// Do not scan OS packages
+	opt.VulnType = []string{types.VulnTypeLibrary}
+
+	// Disable the OS analyzers and individual package analyzers
+	opt.DisabledAnalyzers = append(analyzer.TypeIndividualPkgs, analyzer.TypeOSes...)
+
+	return RunLib(ctx, opt, repositoryScanner, initFSCache)
+}

pkg/commands/artifact/run.go

@@ -41,39 +41,54 @@ func Run(ctx context.Context, opt Option, initializeScanner InitializeScanner, i
 	return runWithTimeout(ctx, opt, initializeScanner, initCache)
 }
 
+// Run performs artifact scanning as library
+func RunLib(ctx context.Context, opt Option, initializeScanner InitializeScanner, initCache InitCache) (pkgReport.Report, error) {
+	ctx, cancel := context.WithTimeout(ctx, opt.Timeout)
+	defer cancel()
+
+	return run(ctx, opt, initializeScanner, initCache)
+}
+
 func runWithTimeout(ctx context.Context, opt Option, initializeScanner InitializeScanner, initCache InitCache) error {
+	_, err := run(ctx, opt, initializeScanner, initCache)
+	return err
+}
+
+func run(ctx context.Context, opt Option, initializeScanner InitializeScanner, initCache InitCache) (pkgReport.Report, error) {
+
+	emptyReport := pkgReport.Report{}
 	if err := log.InitLogger(opt.Debug, opt.Quiet); err != nil {
-		return err
+		return emptyReport, err
 	}
 
 	cacheClient, err := initCache(opt)
 	if err != nil {
 		if errors.Is(err, errSkipScan) {
-			return nil
+			return emptyReport, nil
 		}
-		return xerrors.Errorf("cache error: %w", err)
+		return emptyReport, xerrors.Errorf("cache error: %w", err)
 	}
 	defer cacheClient.Close()
 
 	// When scanning config files, it doesn't need to download the vulnerability database.
 	if utils.StringInSlice(types.SecurityCheckVulnerability, opt.SecurityChecks) {
 		if err = initDB(opt); err != nil {
 			if errors.Is(err, errSkipScan) {
-				return nil
+				return emptyReport, nil
 			}
-			return xerrors.Errorf("DB error: %w", err)
+			return emptyReport, xerrors.Errorf("DB error: %w", err)
 		}
 		defer db.Close()
 	}
 
 	report, err := scan(ctx, opt, initializeScanner, cacheClient)
 	if err != nil {
-		return xerrors.Errorf("scan error: %w", err)
+		return emptyReport, xerrors.Errorf("scan error: %w", err)
 	}
 
 	report, err = filter(ctx, opt, report)
 	if err != nil {
-		return xerrors.Errorf("filter error: %w", err)
+		return emptyReport, xerrors.Errorf("filter error: %w", err)
 	}
 
 	if err = pkgReport.Write(report, pkgReport.Option{
@@ -85,12 +100,12 @@ func runWithTimeout(ctx context.Context, opt Option, initializeScanner Initializ
 		IncludeNonFailures: opt.IncludeNonFailures,
 		Trace:              opt.Trace,
 	}); err != nil {
-		return xerrors.Errorf("unable to write results: %w", err)
+		return emptyReport, xerrors.Errorf("unable to write results: %w", err)
 	}
 
 	exit(opt, report.Results)
 
-	return nil
+	return report, nil
 }
 
 func initFSCache(c Option) (cache.Cache, error) {