Skip to content

fix: output stderr for nonzero exit code #491

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jul 22, 2025
Merged

fix: output stderr for nonzero exit code #491

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f0a69ae
fix: output stderr for nonzero exit code
kzantow Jul 21, 2025
58ea416
chore: merge main
kzantow Jul 21, 2025
eaec285
chore: update tests
kzantow Jul 21, 2025
658a7dc
chore: update tests
kzantow Jul 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 1 addition & 13 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,20 +30,8 @@ jobs:
- 5000:5000
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Build images
run: |
for distro in alpine centos debian; do
docker build -t localhost:5000/match-coverage/$distro ./tests/fixtures/image-$distro-match-coverage
docker push localhost:5000/match-coverage/$distro:latest
done
- name: Inspect
run: |
docker images -a
for distro in alpine centos debian; do
docker buildx imagetools inspect localhost:5000/match-coverage/$distro:latest
done
- run: npm ci
- run: npm run test-ci
- run: npm run test

test-download-action:
runs-on: ubuntu-latest
Expand Down
28 changes: 10 additions & 18 deletions dist/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,7 @@ async function getDbDir(grypeCommand) {
}

async function getDbBuildTime(grypeCommand) {
const { stdout, stderr, exitCode } = await runCommand(
const { stdout, exitCode } = await runCommand(
grypeCommand,
["db", "status", "-vv"],
process.env,
Expand All @@ -198,8 +198,6 @@ async function getDbBuildTime(grypeCommand) {
core.debug("nonzero exit from grype db status; exitCode: " + exitCode);
core.debug("stdout:");
core.debug(stdout);
core.debug("stderr:");
core.debug(stderr);
return;
}
for (let line of stdout.split("\n")) {
Expand Down Expand Up @@ -267,7 +265,6 @@ async function updateDbWithCache(grypeCommand) {

async function runCommand(cmd, cmdArgs, env) {
let stdout = "";
let stderr = "";

// This /dev/null writable stream is required so the entire Grype output
// is not written to the GitHub action log. the listener below
Expand All @@ -288,7 +285,7 @@ async function runCommand(cmd, cmdArgs, env) {
stdout += buffer.toString();
},
stderr(buffer) {
stderr += buffer.toString();
core.info(buffer.toString());
Copy link
Contributor Author

@kzantow kzantow Jul 22, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the same thing sbom-action is doing and it is the only reliable way I was able to get the full stderr log. The behavior before, appending to a string that gets returned seemed to occur before some buffer got flushed and didn't have the full log, so the error at the end is lost ☹️

},
debug(message) {
core.debug(message);
Expand All @@ -299,7 +296,7 @@ async function runCommand(cmd, cmdArgs, env) {

core.debug(stdout);

return { stdout, stderr, exitCode };
return { stdout, exitCode };
}

async function runScan({
Expand Down Expand Up @@ -346,6 +343,8 @@ async function runScan({

if (core.isDebug()) {
cmdArgs.push(`-vv`);
} else {
cmdArgs.push(`-v`);
}

failBuild = failBuild.toLowerCase() === "true";
Expand Down Expand Up @@ -442,21 +441,14 @@ async function runScan({

// If there is a non-zero exit status code there are a couple of potential reporting paths
if (exitCode > 0) {
if (!severityCutoff) {
// There was a non-zero exit status but it wasn't because of failing severity, this must be
// a grype problem
core.warning("grype had a non-zero exit status when running");
} else if (failBuild === true) {
core.setFailed(
if (exitCode === 2) {
(failBuild ? core.setFailed : core.warning)(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
} else {
// There is a non-zero exit status code with severity cut off, although there is still a chance this is grype
// that is broken, it will most probably be a failed severity. Using warning here will make it bubble up in the
// Actions UI
core.warning(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
// There was a non-zero exit status but it wasn't because of failing severity, this must be
// a grype problem
core.setFailed("grype had a non-zero exit status when running");
}
}
return out;
Expand Down
28 changes: 10 additions & 18 deletions index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ async function getDbDir(grypeCommand) {
}

async function getDbBuildTime(grypeCommand) {
const { stdout, stderr, exitCode } = await runCommand(
const { stdout, exitCode } = await runCommand(
grypeCommand,
["db", "status", "-vv"],
process.env,
Expand All @@ -184,8 +184,6 @@ async function getDbBuildTime(grypeCommand) {
core.debug("nonzero exit from grype db status; exitCode: " + exitCode);
core.debug("stdout:");
core.debug(stdout);
core.debug("stderr:");
core.debug(stderr);
return;
}
for (let line of stdout.split("\n")) {
Expand Down Expand Up @@ -253,7 +251,6 @@ async function updateDbWithCache(grypeCommand) {

async function runCommand(cmd, cmdArgs, env) {
let stdout = "";
let stderr = "";

// This /dev/null writable stream is required so the entire Grype output
// is not written to the GitHub action log. the listener below
Expand All @@ -274,7 +271,7 @@ async function runCommand(cmd, cmdArgs, env) {
stdout += buffer.toString();
},
stderr(buffer) {
stderr += buffer.toString();
core.info(buffer.toString());
},
debug(message) {
core.debug(message);
Expand All @@ -285,7 +282,7 @@ async function runCommand(cmd, cmdArgs, env) {

core.debug(stdout);

return { stdout, stderr, exitCode };
return { stdout, exitCode };
}

async function runScan({
Expand Down Expand Up @@ -332,6 +329,8 @@ async function runScan({

if (core.isDebug()) {
cmdArgs.push(`-vv`);
} else {
cmdArgs.push(`-v`);
}

failBuild = failBuild.toLowerCase() === "true";
Expand Down Expand Up @@ -428,21 +427,14 @@ async function runScan({

// If there is a non-zero exit status code there are a couple of potential reporting paths
if (exitCode > 0) {
if (!severityCutoff) {
// There was a non-zero exit status but it wasn't because of failing severity, this must be
// a grype problem
core.warning("grype had a non-zero exit status when running");
} else if (failBuild === true) {
core.setFailed(
if (exitCode === 2) {
(failBuild ? core.setFailed : core.warning)(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
} else {
// There is a non-zero exit status code with severity cut off, although there is still a chance this is grype
// that is broken, it will most probably be a failed severity. Using warning here will make it bubble up in the
// Actions UI
core.warning(
`Failed minimum severity level. Found vulnerabilities with level '${severityCutoff}' or higher`,
);
// There was a non-zero exit status but it wasn't because of failing severity, this must be
// a grype problem
core.setFailed("grype had a non-zero exit status when running");
}
}
return out;
Expand Down
Loading
Loading