docker / docker/scout-action

panic: `github.com/docker/scout-cli-plugin/internal/gha.getPreviousComments`

Open
#87 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

upstream
Dominant language
JavaScript
Stars
141
Forks
53
PR merge metrics
No merged PRs in 30d

Description

settings are (here for reference):

- name: Docker Scout
  uses: docker/scout-action@f8c776824083494ab0d56b8105ba2ca85c86e4de # v1.18.2
  with:
    command: cves,recommendations,compare
    image: archestra/platform:ci-test
    to: docker.io/archestra/platform:latest
    dockerhub-user: ${{ secrets.DOCKER_USERNAME }}
    dockerhub-password: ${{ secrets.DOCKER_PASSWORD }}
    ignore-unchanged: true
    only-severities: critical,high
    write-comment: true
    github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment
    sarif-file: sarif.output.json
✓ SBOM of image already cached, 1522 packages indexed
      ...Pulling
      ✓ Pulled
      ...Storing image for indexing
      ✓ Image stored for indexing
      ...Indexing
      ✓ Indexed 1522 packages
      ✓ Provenance obtained from attestation
      ! Skipping policy evaluation due to missing organization
  panic: runtime error: invalid memory address or nil pointer dereference
  [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x211cb18]
  
  goroutine 1 [running]:
  github.com/docker/scout-cli-plugin/internal/gha.getPreviousComments({0x3079350, 0xc000b187b0}, 0xc048d104d0, {0xc048cfe1f8, 0xc}, {0xc048cfe205, 0x9}, {0xc048d12280, 0x4b})
  	/home/runner/work/scout-cli-plugin/scout-cli-plugin/internal/gha/prcomment.go:165 +0x178
  github.com/docker/scout-cli-plugin/internal/gha.PostComment({0x3079350, 0xc000b187b0}, 0xc0009f0788, {0xc0000547d3, 0x7}, {0xc048cca000, 0xd5d})
  	/home/runner/work/scout-cli-plugin/scout-cli-plugin/internal/gha/prcomment.go:45 +0x3b6
  github.com/docker/scout-cli-plugin/internal/gha.Run({0x3079350, 0xc000b187b0}, 0xc0009f0788, {0xc0000547d3, 0x7}, 0xc0006f32f0, 0xc0003c48c0)
  	/home/runner/work/scout-cli-plugin/scout-cli-plugin/internal/gha/commands.go:134 +0x11c
  main.run()
  	/home/runner/work/scout-cli-plugin/scout-cli-plugin/cmd/github-action/main.go:83 +0x570
  main.main()
  	/home/runner/work/scout-cli-plugin/scout-cli-plugin/cmd/github-action/main.go:94 +0x13

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at internal/gha/prcomment.go:165, where getPreviousComments panics, then trace the call from PostComment in the same file and the workflow entry points in commands.go and cmd/github-action/main.go. Reproduce the supplied Docker Scout configuration and ensure comment posting no longer panics for it.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, go
Domain
ci-cd, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
46/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.