trivy convert always filters non-failures

[martinclaus]

Description

In an CI Job, I am creating a single trivy misconfiguration scan report in JSON Format and then convert this report into different formats using the trivy convert command. The original JSON report is configured to contain also non-failures, however, the reports resulting from conversion do not contain any non-failures.

This is behavior disadvantageous, if you generate a JUnit Report, since the CI, which is capable of integrating theses reports in the pipeline UI, will not show the checks that has been passed. And it is particularly confusing if all checks have been passed but none are displayed.

Desired Behavior

I expect that

trivy filesystem --scanners misconfig --include-non-failures --format json --output "report.json" .
trivy convert --format template --template "@contrib/junit.tpl" --output "report.junit.xml" "report.json"

and

trivy filesystem --scanners misconfig --include-non-failures --format template --template "@contrib/junit.tpl" --output "report.junit.xml" .

Produce identical files report.junit.xml.

Actual Behavior

Reports of a Dockerfile containing only FROM alpine:latest share the failed but lack the passed test cases:

--- desired_report.junit.xml
+++ test_report.junit.xml
@@ -18,55 +18,5 @@
         <testcase classname="Dockerfile Security Check" name="[LOW] DS026" time="">
             <failure message="No HEALTHCHECK defined" type="description">You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.</failure>
         </testcase>
-        <testcase classname="Dockerfile Security Check" name="[MEDIUM] DS004" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[LOW] DS005" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[CRITICAL] DS006" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[CRITICAL] DS007" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[CRITICAL] DS008" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS009" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[CRITICAL] DS010" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[CRITICAL] DS011" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[CRITICAL] DS012" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[MEDIUM] DS013" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[LOW] DS014" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS015" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS016" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS017" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS019" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS020" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS021" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS022" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[MEDIUM] DS023" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS024" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS025" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS027" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS029" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[HIGH] DS030" time="">
-        </testcase>
-        <testcase classname="Dockerfile Security Check" name="[CRITICAL] DS031" time="">
-        </testcase>
     </testsuite>
 </testsuites>

Reproduction Steps

1. echo "FROM alpine:latest" > Dockerfile
2. trivy filesystem --scanners misconfig --include-non-failures --format template --template "@contrib/junit.tpl" --output "desired_report.junit.xml" .
3. trivy filesystem --scanners misconfig --include-non-failures --format json --output "report.json" .
4. trivy convert --format template --template "@contrib/junit.tpl" --output "test_report.junit.xml" "report.json"
5. diff desired_report.junit.xml test_report.junit.xml

Target

Filesystem

Scanner

Misconfiguration

Output Format

Template

Mode

Standalone

Debug Output

`trivy convert --format template --template "@contrib/junit.tpl" --output "test_report.junit.xml" "report.json" --debug`

2025-02-19T15:59:51Z    DEBUG   No plugins loaded
2025-02-19T15:59:51Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-02-19T15:59:51Z    DEBUG   Cache dir       dir="/trivy/.cache/trivy"
2025-02-19T15:59:51Z    DEBUG   Cache dir       dir="/trivy/.cache/trivy"
2025-02-19T15:59:51Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-02-19T15:59:51Z    DEBUG   Specified ignore file does not exist    file=".trivyignore"
2025-02-19T15:59:51Z    DEBUG   [vex] VEX filtering is disabled
2025-02-19T15:59:51Z    DEBUG   Writing report to output...

Operating System

Linux

Version

Version: 0.59.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-02-19 06:16:52.057053042 +0000 UTC
  NextUpdate: 2025-02-20 06:16:52.057052812 +0000 UTC
  DownloadedAt: 2025-02-19 10:40:57.960950223 +0000 UTC
Check Bundle:
  Digest: sha256:ac89e7d82ab5feeabc055a454066bc182f9248e96b8ecb1ca5810cd59c659800
  DownloadedAt: 2025-02-19 10:42:49.863396592 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[martinclaus]

I just tried to use following trivy.yaml:

misconfiguration:
  # Same as '--include-non-failures'
  # Default is false
  include-non-failures: true

but without any success. The behavior is the same.

[nikpivkin]

Hi @martinclaus ! Thanks for the report.

[nikpivkin]

@simar7 @knqyf263

I think there are two ways:

• When converting the JSON report, consume everything in it and enable the include-non-failures option by default, since the filtering has already been applied during the scan.
• Provide the same filtering options for the convert command as those available for scanning. This would allow flexible result filtering across different formats.

WDYT?

[acnickv]

I am experiencing the same issue.

I am using the latest version with a config file. But when I specify --include-non-failures on the convert command line I receive an error.

$ trivy --version

2025-04-02T15:05:59Z    INFO    Loaded  file_path="trivy.yaml"

Version: 0.60.0

Vulnerability DB:

  Version: 2

  UpdatedAt: 2025-04-02 12:19:19.8246537 +0000 UTC

  NextUpdate: 2025-04-03 12:19:19.82465351 +0000 UTC

  DownloadedAt: 2025-04-02 14:19:23.087018144 +0000 UTC

 

$ trivy convert --include-non-failures --debug --format template --template @/usr/local/share/trivy/templates/contrib/junit.tpl --output ./build/trivy-results.xml ./build/trivy-results.json

Convert Trivy JSON report into a different format

 

Usage:

  trivy convert [flags] RESULT_JSON

 

Aliases:

  convert, conv

 

Examples:

  # report conversion

  $ trivy image --format json --output result.json --list-all-pkgs debian:11

  $ trivy convert --format cyclonedx --output result.cdx result.json

 

 

Scan Flags

      --scanners strings   List of scanners included when generating the json report. Used only for rendering the summary table. (vuln,misconfig,secret,license)

 

Report Flags

      --compliance string          compliance report to generate

      --dependency-tree            [EXPERIMENTAL] show dependency origin tree of vulnerable packages

      --exit-code int              specify exit code when any security issues are found

      --exit-on-eol int            exit with the specified code when the OS reaches end of service/life

  -f, --format string              format (table,json,template,sarif,cyclonedx,spdx,spdx-json,github,cosign-vuln) (default "table")

      --ignore-policy string       specify the Rego file path to evaluate each vulnerability

      --ignorefile string          specify .trivyignore file (default ".trivyignore")

      --list-all-pkgs              output all packages in the JSON report regardless of vulnerability

  -o, --output string              output file name

      --output-plugin-arg string   [EXPERIMENTAL] output plugin arguments

      --report string              specify a report format for the output (all,summary) (default "all")

  -s, --severity strings           severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL])

      --show-suppressed            [EXPERIMENTAL] show suppressed vulnerabilities

      --table-mode strings         [EXPERIMENTAL] tables that will be displayed in 'table' format (summary,detailed) (default [summary,detailed])

  -t, --template string            output template

 

Global Flags:

      --cache-dir string          cache directory (default "/home/nanav01/.cache/trivy")

  -c, --config string             config path (default "trivy.yaml")

  -d, --debug                     debug mode

      --generate-default-config   write the default config to trivy-default.yaml

      --insecure                  allow insecure server connections

  -q, --quiet                     suppress progress bar and log output

      --timeout duration          timeout (default 5m0s)

  -v, --version                   show version

 

2025-04-02T15:06:16Z    FATAL   Fatal error     unknown flag: --include-non-failures

[simar7]

@nikpivkin I think the convert command should not do anything but convert, so the fact that it drops non failures is a bug to me rather than expected behavior.

But to your point, if the convert command outputs an equivalent converted report - the non failures will be preserved and as a result will not require any redesign of the options.

[nikpivkin]

Track #8670