From 6fe5e92afa72a427945cc63b6cd2c1f9ce34f605 Mon Sep 17 00:00:00 2001
From: Josh Sokol <josh@simplerisk.com>
Date: Tue, 29 Sep 2026 18:07:56 -0500
Subject: [PATCH] ci: post the per-image scan table to Slack on PR and weekly
 runs, even with no findings

Adds an always_post input to the grype-report action. When true, the Slack
message carries one status line per scanned image (clean, findings by severity,
or scan did not complete), so a quiet run still proves its scans ran.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/actions/grype-report/action.yml    | 14 +++++++++++++
 .github/scripts/grype-scan-summary.sh      | 18 +++++++++++-----
 .github/scripts/grype-slack-digest.sh      | 24 ++++++++++++++++++----
 .github/workflows/container-validation.yml |  1 +
 .github/workflows/scheduled-grype-scan.yml |  1 +
 5 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/.github/actions/grype-report/action.yml b/.github/actions/grype-report/action.yml
index af34948..0282ed8 100644
--- a/.github/actions/grype-report/action.yml
+++ b/.github/actions/grype-report/action.yml
@@ -13,6 +13,12 @@ inputs:
     description: Slack incoming webhook. When empty, the Slack post is skipped.
     required: false
     default: ''
+  always_post:
+    description: >
+      'true' posts the per-image table to Slack even when there are no findings, so a
+      quiet run still shows that its scans ran. Otherwise Slack only hears about findings.
+    required: false
+    default: 'false'
   context:
     description: Text shown in the Slack message (workflow name and branch).
     required: false
@@ -45,7 +51,15 @@ runs:
         SLACK_WEBHOOK_URL: ${{ inputs.slack_webhook_url }}
         RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         REF: ${{ inputs.context }}
+        RESULTS: ${{ inputs.results }}
+        ALWAYS_POST: ${{ inputs.always_post }}
       run: |
+        if [ "$ALWAYS_POST" = "true" ]; then
+          mkdir -p grype-reports
+          mapfile -t pairs < <(printf '%s\n' "$RESULTS" | sed '/^[[:space:]]*$/d')
+          SUMMARY="$(SUMMARY_FORMAT=slack "${{ github.action_path }}/../../scripts/grype-scan-summary.sh" grype-reports "${pairs[@]}")"
+          export SUMMARY
+        fi
         payload="$("${{ github.action_path }}/../../scripts/grype-slack-digest.sh" grype-reports)"
         if [ -z "$payload" ]; then
           echo "No Grype findings in any image; nothing to post."
diff --git a/.github/scripts/grype-scan-summary.sh b/.github/scripts/grype-scan-summary.sh
index fa8fdf9..ee7cfa8 100755
--- a/.github/scripts/grype-scan-summary.sh
+++ b/.github/scripts/grype-scan-summary.sh
@@ -15,10 +15,14 @@ set -euo pipefail
 dir="${1:?usage: $0 <dir> <label>=<result>...}"
 shift
 
-echo "### Grype scan results"
-echo
-echo "| Image | Result |"
-echo "| --- | --- |"
+# SUMMARY_FORMAT=slack prints mrkdwn lines for the Slack digest instead of a table.
+format="${SUMMARY_FORMAT:-markdown}"
+if [ "$format" != "slack" ]; then
+  echo "### Grype scan results"
+  echo
+  echo "| Image | Result |"
+  echo "| --- | --- |"
+fi
 for pair in "$@"; do
   label="${pair%%=*}"
   result="${pair#*=}"
@@ -37,5 +41,9 @@ for pair in "$@"; do
       status="⚠️ ${count} findings (${detail})"
     fi
   fi
-  echo "| \`${label}\` | ${status} |"
+  if [ "$format" = "slack" ]; then
+    echo "\`${label}\`  ${status}"
+  else
+    echo "| \`${label}\` | ${status} |"
+  fi
 done
diff --git a/.github/scripts/grype-slack-digest.sh b/.github/scripts/grype-slack-digest.sh
index 2ebe85d..cb8769e 100755
--- a/.github/scripts/grype-slack-digest.sh
+++ b/.github/scripts/grype-slack-digest.sh
@@ -8,7 +8,11 @@
 # Env (all optional, used only for the message header/links):
 #   RUN_URL  link to the workflow run      REF  branch or PR ref
 #
-# Prints the JSON payload on stdout, or nothing when there are no findings.
+#   SUMMARY  optional per-image status lines (from grype-scan-summary.sh, slack format).
+#            When set, a payload is produced even with no findings (the all-clear
+#            table), so a quiet run still shows that its scans ran.
+#
+# Prints the JSON payload on stdout, or nothing when there are no findings and no SUMMARY.
 # Findings are de-duplicated across images (one line per package + vulnerability,
 # listing every image it affects), sorted by package, then severity (worst first),
 # then vulnerability ID, so the message reads as "what is vulnerable right now".
@@ -17,11 +21,12 @@ set -euo pipefail
 dir="${1:?usage: $0 <dir>}"
 shopt -s nullglob
 files=("$dir"/*/grype.json)
-[ "${#files[@]}" -gt 0 ] || exit 0
+[ "${#files[@]}" -gt 0 ] || [ -n "${SUMMARY:-}" ] || exit 0
 
 jq -n \
   --arg run_url "${RUN_URL:-}" \
   --arg ref "${REF:-}" \
+  --arg summary "${SUMMARY:-}" \
   --argjson max_blocks 45 \
   --argjson max_chars 2900 '
   def rank: {"Critical":0,"High":1,"Medium":2,"Low":3,"Negligible":4}[.] // 5;
@@ -39,7 +44,17 @@ jq -n \
       fixed: ((.vulnerability.fix.versions // []) | join(", ")),
       id: .vulnerability.id, sev: .vulnerability.severity,
       url: (.vulnerability.dataSource // ""), label: $label}] as $rows
-  | if ($rows | length) == 0 then empty else
+  | ($summary | if . == "" then [] else [{type: "section", text: {type: "mrkdwn", text: .}}] end) as $summary_blocks
+  | if ($rows | length) == 0 then
+      (if $summary == "" then empty else {
+        text: "Grype scan results",
+        blocks: (
+          [{type: "header", text: {type: "plain_text", text: "Grype scan results"}},
+           {type: "context", elements: [{type: "mrkdwn",
+             text: ("`\($ref)`" + (if $run_url != "" then " · <\($run_url)|workflow run>" else "" end))}]}]
+          + $summary_blocks)
+      } end)
+    else
     ($rows | group_by([.pkg, .id]) | map(. + [] | {
         pkg: .[0].pkg, id: .[0].id, sev: .[0].sev, url: .[0].url,
         ver: ([.[].ver] | unique | join(", ")),
@@ -60,6 +75,7 @@ jq -n \
              text: "Grype findings: \($vulns | length) unique (\($summary))"}},
            {type: "context", elements: [{type: "mrkdwn",
              text: ("`\($ref)`" + (if $run_url != "" then " · <\($run_url)|workflow run>" else "" end))}]}]
+          + $summary_blocks
           + ($chunks[:$max_blocks] | map({type: "section", text: {type: "mrkdwn", text: .}}))
           + (if ($chunks | length) > $max_blocks
              then [{type: "context", elements: [{type: "mrkdwn",
@@ -67,4 +83,4 @@ jq -n \
              else [] end))
       }
     end
-' "${files[@]}"
+' ${files[@]+"${files[@]}"}
diff --git a/.github/workflows/container-validation.yml b/.github/workflows/container-validation.yml
index 970a872..094b290 100644
--- a/.github/workflows/container-validation.yml
+++ b/.github/workflows/container-validation.yml
@@ -79,6 +79,7 @@ jobs:
         with:
           slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
           context: ${{ github.workflow }} · ${{ github.head_ref || github.ref_name }}
+          always_post: 'true'
           results: |
             jammy=${{ needs.simplerisk-jammy.result }}
             noble=${{ needs.simplerisk-noble.result }}
diff --git a/.github/workflows/scheduled-grype-scan.yml b/.github/workflows/scheduled-grype-scan.yml
index 8d13025..db7068c 100644
--- a/.github/workflows/scheduled-grype-scan.yml
+++ b/.github/workflows/scheduled-grype-scan.yml
@@ -51,6 +51,7 @@ jobs:
         with:
           slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
           context: ${{ github.workflow }} · testing
+          always_post: 'true'
           results: |
             testing-minimal=${{ needs.scan-minimal.result }}
             testing-full=${{ needs.scan-full.result }}