fix(cli): ensure correct command is picked by telemetry #9260

owenrumney · 2025-07-28T15:06:11Z

Description

Suppose the user has an unexpected ordering of flags in their Trivy command. In that case, the simple approach of reading the first OS argument fails, and the information in the Trivy-Command header for telemetry is incorrect.

Rather than using the os.Args, this PR passes the targetKind into the NewRunner creation so that it can be used as the command name

Example

Taking the following example

trivy -d image nginx

Before
call req.Header.Get("Trivy-Command") would result in -d as the first os.Arg would be returned

With Change
With this change, we now get consistently the correct command
call req.Header.Get("Trivy-Command") returns "image"

Closes

fix(cli): unexpected ordering in trivy args records the wrong command #9259

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

owenrumney · 2025-07-28T15:41:03Z

@knqyf263 and @DmitriyLewen - more than welcome any preferred ways to do this. I wanted to avoid changing the instantiation of a Runner by changing the interface for NewRunner, I'm aware there are projects that use Trivy as a library and this entry point

DmitriyLewen · 2025-07-29T06:46:59Z

we consider Trivy primarily as CLI. And we should focus on this, and not on users who use Trivy as a library. @knqyf263 correct me if I'm wrong.
So for us versionChecker is a mandatory field. So using WithVersionChecker is not quite right (this pattern is usually used when you need to override the default value, and not set it).

so I think we can add TargetKind for NewRunner (func NewRunner(ctx context.Context, cliOptions flag.Options, targetKind TargetKind, opts ...RunnerOption) (Runner, error) {)

If the user has an unexpected ordering of flags in their Trivy command, the simple approach of reading the first OS arg falls down and the inforamtion in the `Trivy-Command` header to the telemetry is incorrect. Rather than using the os.Args, this PR passes the `targetKind` into the NewRunner func to be used as the command

DmitriyLewen

LGTM

knqyf263 · 2025-07-29T11:35:57Z

we consider Trivy primarily as CLI. And we should focus on this, and not on users who use Trivy as a library.

While it's true, we need to communicate with Aqua internally first as it can break their enterprise edition.

pkg/commands/artifact/run.go

knqyf263

🚀

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.64.1` -> `0.65.0` | --- ### Release Notes <details> <summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary> ### [`v0.65.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0650-2025-07-30) [Compare Source](aquasecurity/trivy@v0.64.1...v0.65.0) ##### Features - add graceful shutdown with signal handling ([#9242](aquasecurity/trivy#9242)) ([2c05882](aquasecurity/trivy@2c05882)) - add HTTP request/response tracing support ([#9125](aquasecurity/trivy#9125)) ([aa5b32a](aquasecurity/trivy@aa5b32a)) - **alma:** add AlmaLinux 10 support ([#9207](aquasecurity/trivy#9207)) ([861d51e](aquasecurity/trivy@861d51e)) - **flag:** add schema validation for `--server` flag ([#9270](aquasecurity/trivy#9270)) ([ed4640e](aquasecurity/trivy@ed4640e)) - **image:** add Docker context resolution ([#9166](aquasecurity/trivy#9166)) ([99cd4e7](aquasecurity/trivy@99cd4e7)) - **license:** observe pkg types option in license scanner ([#9091](aquasecurity/trivy#9091)) ([d44af8c](aquasecurity/trivy@d44af8c)) - **misconf:** add private ip google access attribute to subnetwork ([#9199](aquasecurity/trivy#9199)) ([263845c](aquasecurity/trivy@263845c)) - **misconf:** added logging and versioning to the gcp storage bucket ([#9226](aquasecurity/trivy#9226)) ([110f80e](aquasecurity/trivy@110f80e)) - **repo:** add git repository metadata to reports ([#9252](aquasecurity/trivy#9252)) ([f4b2cf1](aquasecurity/trivy@f4b2cf1)) - **report:** add CVSS vectors in sarif report ([#9157](aquasecurity/trivy#9157)) ([60723e6](aquasecurity/trivy@60723e6)) - **sbom:** add SHA-512 hash support for CycloneDX SBOM ([#9126](aquasecurity/trivy#9126)) ([12d6706](aquasecurity/trivy@12d6706)) ##### Bug Fixes - **alma:** parse epochs from rpmqa file ([#9101](aquasecurity/trivy#9101)) ([82db2fc](aquasecurity/trivy@82db2fc)) - also check `filepath` when removing duplicate packages ([#9142](aquasecurity/trivy#9142)) ([4d10a81](aquasecurity/trivy@4d10a81)) - **aws:** update amazon linux 2 EOL date ([#9176](aquasecurity/trivy#9176)) ([0ecfed6](aquasecurity/trivy@0ecfed6)) - **cli:** Add more non-sensitive flags to telemetry ([#9110](aquasecurity/trivy#9110)) ([7041a39](aquasecurity/trivy@7041a39)) - **cli:** ensure correct command is picked by telemetry ([#9260](aquasecurity/trivy#9260)) ([b4ad00f](aquasecurity/trivy@b4ad00f)) - **cli:** panic: attempt to get os.Args\[1] when len(os.Args) < 2 ([#9206](aquasecurity/trivy#9206)) ([adfa879](aquasecurity/trivy@adfa879)) - **license:** add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping ([#9116](aquasecurity/trivy#9116)) ([a692f29](aquasecurity/trivy@a692f29)) - **license:** handle WITH operator for `LaxSplitLicenses` ([#9232](aquasecurity/trivy#9232)) ([b4193d0](aquasecurity/trivy@b4193d0)) - migrate from `*.list` to `*.md5sums` files for `dpkg` ([#9131](aquasecurity/trivy#9131)) ([f224de3](aquasecurity/trivy@f224de3)) - **misconf:** correctly adapt azure storage account ([#9138](aquasecurity/trivy#9138)) ([51aa022](aquasecurity/trivy@51aa022)) - **misconf:** correctly parse empty port ranges in google\_compute\_firewall ([#9237](aquasecurity/trivy#9237)) ([77bab7b](aquasecurity/trivy@77bab7b)) - **misconf:** fix log bucket in schema ([#9235](aquasecurity/trivy#9235)) ([7ebc129](aquasecurity/trivy@7ebc129)) - **misconf:** skip rewriting expr if attr is nil ([#9113](aquasecurity/trivy#9113)) ([42ccd3d](aquasecurity/trivy@42ccd3d)) - **nodejs:** don't use prerelease logic for compare npm constraints ([#9208](aquasecurity/trivy#9208)) ([fe96436](aquasecurity/trivy@fe96436)) - prevent graceful shutdown message on normal exit ([#9244](aquasecurity/trivy#9244)) ([6095984](aquasecurity/trivy@6095984)) - **rootio:** check full version to detect `root.io` packages ([#9117](aquasecurity/trivy#9117)) ([c2ddd44](aquasecurity/trivy@c2ddd44)) - **rootio:** fix severity selection ([#9181](aquasecurity/trivy#9181)) ([6fafbeb](aquasecurity/trivy@6fafbeb)) - **sbom:** merge in-graph and out-of-graph OS packages in scan results ([#9194](aquasecurity/trivy#9194)) ([aa944cc](aquasecurity/trivy@aa944cc)) - **sbom:** use correct field for licenses in CycloneDX reports ([#9057](aquasecurity/trivy#9057)) ([143da88](aquasecurity/trivy@143da88)) - **secret:** add UTF-8 validation in secret scanner to prevent protobuf marshalling errors ([#9253](aquasecurity/trivy#9253)) ([54832a7](aquasecurity/trivy@54832a7)) - **secret:** fix line numbers for multiple-line secrets ([#9104](aquasecurity/trivy#9104)) ([e579746](aquasecurity/trivy@e579746)) - **server:** add HTTP transport setup to server mode ([#9217](aquasecurity/trivy#9217)) ([1163b04](aquasecurity/trivy@1163b04)) - supporting .egg-info/METADATA in python.Packaging analyzer ([#9151](aquasecurity/trivy#9151)) ([e306e2d](aquasecurity/trivy@e306e2d)) - **terraform:** `for_each` on a map returns a resource for every key ([#9156](aquasecurity/trivy#9156)) ([153318f](aquasecurity/trivy@153318f)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1073 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

…#9260)

owenrumney marked this pull request as ready for review July 28, 2025 15:39

owenrumney requested a review from knqyf263 as a code owner July 28, 2025 15:39

owenrumney requested a review from DmitriyLewen July 28, 2025 15:39

owenrumney force-pushed the fix/infer-correct-target-kind branch from e57e563 to 3077b23 Compare July 28, 2025 15:49

owenrumney requested review from afdesk and simar7 as code owners July 28, 2025 15:49

owenrumney force-pushed the fix/infer-correct-target-kind branch from 3077b23 to e051815 Compare July 29, 2025 07:49

owenrumney marked this pull request as draft July 29, 2025 07:49

owenrumney self-assigned this Jul 29, 2025

owenrumney marked this pull request as ready for review July 29, 2025 08:38

DmitriyLewen approved these changes Jul 29, 2025

View reviewed changes

Merge branch 'main' into fix/infer-correct-target-kind

4edc984

nikpivkin reviewed Jul 30, 2025

View reviewed changes

pkg/commands/artifact/run.go Show resolved Hide resolved

Merge branch 'main' into fix/infer-correct-target-kind

6e25360

knqyf263 approved these changes Jul 30, 2025

View reviewed changes

owenrumney added this pull request to the merge queue Jul 30, 2025

Merged via the queue into aquasecurity:main with commit b4ad00f Jul 30, 2025
13 checks passed

owenrumney deleted the fix/infer-correct-target-kind branch July 30, 2025 10:52

aqua-bot mentioned this pull request Jul 30, 2025

release: v0.65.0 [main] #9108

Merged

yutatokoi pushed a commit to yutatokoi/trivy that referenced this pull request Aug 12, 2025

fix(cli): ensure correct command is picked by telemetry (aquasecurity…

412af5c

…#9260)

owenrumney mentioned this pull request Aug 25, 2025

fix(cli): unexpected ordering in trivy args records the wrong command #9259

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(cli): ensure correct command is picked by telemetry #9260

fix(cli): ensure correct command is picked by telemetry #9260

owenrumney commented Jul 28, 2025 •

edited

Loading

Uh oh!

owenrumney commented Jul 28, 2025

Uh oh!

DmitriyLewen commented Jul 29, 2025

Uh oh!

DmitriyLewen left a comment

Uh oh!

knqyf263 commented Jul 29, 2025

Uh oh!

Uh oh!

knqyf263 left a comment

Uh oh!

Uh oh!

Uh oh!

fix(cli): ensure correct command is picked by telemetry #9260

fix(cli): ensure correct command is picked by telemetry #9260

Conversation

owenrumney commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Example

Closes

Checklist

Uh oh!

owenrumney commented Jul 28, 2025

Uh oh!

DmitriyLewen commented Jul 29, 2025

Uh oh!

DmitriyLewen left a comment

Choose a reason for hiding this comment

Uh oh!

knqyf263 commented Jul 29, 2025

Uh oh!

Uh oh!

knqyf263 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

owenrumney commented Jul 28, 2025 •

edited

Loading