-
Notifications
You must be signed in to change notification settings - Fork 115
Add image scope scanning option to the Linux detector #1621
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add image scope scanning option to the Linux detector #1621
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1621 +/- ##
======================================
Coverage 90.2% 90.2%
======================================
Files 437 437
Lines 37801 37905 +104
Branches 2324 2330 +6
======================================
+ Hits 34121 34228 +107
+ Misses 3203 3199 -4
- Partials 477 478 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
Adds a configurable Syft image scanning scope to the Linux detector so callers can switch from the default all-layers scan to squashed for improved performance when scanning all layers isn’t needed.
Changes:
- Introduces
LinuxScannerScopeand threads it throughLinuxContainerDetector -> ILinuxScanner -> LinuxScannerto control Syft’s--scopeflag. - Parses
Linux.ImageScanScopefrom--DetectorArgs(defaulting toall-layers) and adds/updates unit tests for scope handling. - Documents the new detector argument in the Linux detector docs.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| test/Microsoft.ComponentDetection.Detectors.Tests/LinuxScannerTests.cs | Updates existing calls to include scope and adds tests asserting correct --scope flag behavior. |
| test/Microsoft.ComponentDetection.Detectors.Tests/LinuxContainerDetectorTests.cs | Adds coverage ensuring detector args drive the scope passed into the scanner. |
| src/Microsoft.ComponentDetection.Detectors/linux/LinuxScannerScope.cs | Defines the new scope enum (AllLayers, Squashed). |
| src/Microsoft.ComponentDetection.Detectors/linux/LinuxScanner.cs | Builds the Syft command using scope-specific arguments and validates enum values. |
| src/Microsoft.ComponentDetection.Detectors/linux/LinuxContainerDetector.cs | Reads Linux.ImageScanScope from detector args and passes it through the scan pipeline. |
| src/Microsoft.ComponentDetection.Detectors/linux/ILinuxScanner.cs | Extends the scanner interface to accept the new scope parameter. |
| docs/detectors/linux.md | Documents the new Linux.ImageScanScope argument and its expected values. |
test/Microsoft.ComponentDetection.Detectors.Tests/LinuxContainerDetectorTests.cs
Show resolved
Hide resolved
…d-linux-syft-scope-param
|
👋 Hi! It looks like you modified some files in the
If none of the above scenarios apply, feel free to ignore this comment 🙂 |
Reverts #1613
Add the ability to configure the image scanning scope used by Syft for the Linux detector.
This allows your to pass in the argument --DetectorArgs Linux.ImageScanScope=squashed to have the detector invoke Syft with --scope squashed instead of the default of --scope all-layers.
If components from all layers are not needed, squashed has significant performance benefits.