feat(locations): container scanners emit the scanned image as an Image location - #15999
Merged
Merged
Conversation
…d hierarchy edges Documents the Pro code-to-cloud work: the Container Image location type (registry, repository, digest and tag, tag-only rows kept distinct), where images appear (All Images, the asset location map region, the finding's Runs in tile), the image to repository link and its manual override, the suggested deploys-to edges on the hierarchy page, and the Container Image root cause type. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
blakeaowens
force-pushed
the
parsers/container-image-locations
branch
from
September 18, 2026 01:46
eb44f1b to
cedeed0
Compare
…e location Adds LocationData.image, a six-key contract (registry, repository, digest, tag, oci_source, oci_revision) that Pro's Container Image location type consumes, and split_image_reference, which splits a raw image reference without normalising it. Open-source imports are unchanged: LocationManager already drops location types it does not know, so the new items only take effect where a consumer registers the image type. Five parsers attach the scanned image to every finding of a container scan, one location per digest the image is known by and a tag-only location when the scanner reports no digest: Trivy (ArtifactType container_image, Metadata.RepoDigests and RepoTags), Grype (source.target repo digests, else the manifest digest with the user's reference), Anchore Enterprise (the evaluated image id and tag), Trivy Operator (report.artifact and report.registry, on vulnerability and secret reports), and Snyk Container (docker-image projects, tag from path, no digest). Tests assert the exact data dicts on existing fixtures and one small fabricated Trivy report with two repo digests; a table test covers the splitter. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Maffooch
approved these changes
Sep 18, 2026
devGregA
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Container scanners emit the scanned image as an Image location
Open-source half of the Pro code-to-cloud work (Container Image Locations). The documentation for the feature merged separately in #15979; this PR is the parser contract only. Text-only description.
What changes
dojo/tools/locations.py:LocationData.image(...)with exactly six keys (registry,repository,digest,tag,oci_source,oci_revision), always present, andsplit_image_reference(reference)which splits[registry/]repository[:tag][@digest]into raw parts without normalising them. The first path segment counts as a registry only when it contains a dot or a colon or islocalhost, songinx:1.25has no registry and the consumer decides the default.locations_enabled(), one location per digest the image is known by, else one tag-only location:ArtifactType == "container_image",Metadata.RepoDigestsandRepoTags,ArtifactNameas the fallback. Filesystem, repository and SBOM scans add nothing.source.type == "image";repoDigestswhen present, elsemanifestDigestwith the user's reference.repository:tagin the policy row.report.artifactandreport.registry.serveron vulnerability and exposed-secret reports.projectNamestarting withdocker-image|, tag read frompath; Snyk reports no digest.Behaviour without a consumer
Open-source imports are unchanged:
LocationManager.make_abstract_locationsdrops types it does not know with a debug log, so the new items are inert until an installation registers the image type.Tests
datadict assertions on existing fixtures for all five parsers, guarded withskip_unless_v3.unittests/scans/trivy/image_multi_digest.json) with two repo digests, asserting two locations that share the tag.split_image_referenceand the six-key shape.Pairs with the DefectDojo Pro pull request for the same story (base
bugfix, milestone 3.3.200).🤖 Generated with Claude Code