trivy
trivy copied to clipboard
refactor(template): change `source_location` in `github` template for aggregated packages
Description
We use target field for source_location in github template.
But we aggregate some packages:
https://github.com/aquasecurity/trivy/blob/fb36c4ed09efc3fc241d02713c4cc864b6c6a2c8/pkg/fanal/applier/docker.go#L263-L291
For these packages target is Python, Java, etc.
This is problem for GitHub UI - #5998.
We need to use Results.Packages.FilePath for these packages.
But filePath for image scans can be large (e.g. "FilePath": "usr/local/lib/python3.12/site-packages/pip-23.2.1.dist-info/METADATA").
It might make sense to use image name for image mode.