From bec87f12bbfeed7f8eb598f45068a3139a28b7a5 Mon Sep 17 00:00:00 2001
From: ychangkim <kkmbal@gmail.com>
Date: Tue, 21 Jul 2026 17:00:41 +0900
Subject: [PATCH] feat: emit one CVE result per (catalog, version) instead of
 per image

Replace the per-image catalogs array with a flat structure: results
are now keyed by (catalog, version), with the same image's scan
counts duplicated across every chart/version that references it.
---
 .github/workflows/cve-edge-post.yml | 51 ++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/cve-edge-post.yml b/.github/workflows/cve-edge-post.yml
index 5625146..0296ba2 100644
--- a/.github/workflows/cve-edge-post.yml
+++ b/.github/workflows/cve-edge-post.yml
@@ -1,9 +1,12 @@
 name: helm-catalog-cve-edge-post
 
 # manifests/helm 카탈로그의 컨테이너 이미지 취약점을 스캔해 단일 JSON 요약으로 출력한다.
-#   [{"image": "...", "low": 0, "high": 0, "medium": 0, "critical": 0,
+#   [{"catalog": "airflow", "version": "1.0.0", "image": "...",
+#     "low": 0, "high": 0, "medium": 0, "critical": 0,
 #     "scanned_at": "2026-07-13T06:19:44Z",
 #     "summary": "CVE-xxxx-xxxxx: short description; CVE-yyyy-yyyyy: ..."}, ...]
+# 배열 원소는 (catalog, version) 기준이다 — 하나의 이미지가 여러 chart/version
+# (manifests/helm/<name>/<version>/)에서 재사용되면 그 조합 수만큼 항목이 중복 생성된다.
 # summary 는 CRITICAL 취약점만 대상이며, CVE ID 별로 trivy 가 제공하는 Title(또는
 # Description 첫 문장)을 짧은 설명으로 붙인다.
 # 생성된 JSON 은 POST https://edge.gke.paasup.io/api/v1/cve-scans 로 전송한다.
@@ -24,7 +27,7 @@ on:
         required: false
         default: '0'
   schedule:
-    - cron: '0 18 * * 6'
+    - cron: '0 10 * * 0'
 
 permissions:
   contents: read
@@ -118,17 +121,29 @@ jobs:
               || echo "::warning::스캔 실패: $img"
           ' _ {} "$REPORTS_DIR" < "$OUT_DIR/images_scan.txt"
 
-      # trivy-reports/*.json (이미지별 원본 Trivy 결과)을 python3 로 이미지별 집계.
+      # trivy-reports/*.json (이미지별 원본 Trivy 결과)을 python3 로 집계한 뒤,
+      # images_final.tsv(chart⇥version⇥image) 기준으로 (catalog, version) 별 항목을 만든다.
+      # 하나의 이미지가 여러 chart/version 에서 쓰이면 그 수만큼 결과가 중복 생성된다.
       - name: CVE JSON 생성
         run: |
-          python3 - "$OUT_DIR/trivy-reports" "$OUT_DIR/cve-summary.json" <<'PY'
-          import sys, os, json, glob
+          python3 - "$OUT_DIR/trivy-reports" "$OUT_DIR/images_final.tsv" "$OUT_DIR/cve-summary.json" <<'PY'
+          import sys, os, json, glob, collections
           from datetime import datetime, timezone
 
-          reports_dir, out_path = sys.argv[1], sys.argv[2]
+          reports_dir, images_final_path, out_path = sys.argv[1], sys.argv[2], sys.argv[3]
           scanned_at = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-          results = []
 
+          image_catalogs = collections.defaultdict(list)
+          if os.path.exists(images_final_path):
+              with open(images_final_path) as f:
+                  for line in f:
+                      parts = line.rstrip("\n").split("\t")
+                      if len(parts) >= 3 and parts[2]:
+                          entry = (parts[0], parts[1])
+                          if entry not in image_catalogs[parts[2]]:
+                              image_catalogs[parts[2]].append(entry)
+
+          results = []
           for path in sorted(glob.glob(os.path.join(reports_dir, "*.json"))):
               with open(path) as f:
                   data = json.load(f)
@@ -150,15 +165,19 @@ jobs:
                   f"{vid}: {desc}" if desc else vid
                   for vid, desc in sorted(critical_desc.items())
               )
-              results.append({
-                  "image": image,
-                  "low": counts["LOW"],
-                  "high": counts["HIGH"],
-                  "medium": counts["MEDIUM"],
-                  "critical": counts["CRITICAL"],
-                  "scanned_at": scanned_at,
-                  "summary": summary,
-              })
+
+              for catalog, version in image_catalogs.get(image, [("", "")]):
+                  results.append({
+                      "catalog": catalog,
+                      "version": version,
+                      "image": image,
+                      "low": counts["LOW"],
+                      "high": counts["HIGH"],
+                      "medium": counts["MEDIUM"],
+                      "critical": counts["CRITICAL"],
+                      "scanned_at": scanned_at,
+                      "summary": summary,
+                  })
 
           with open(out_path, "w") as f:
               json.dump(results, f)