goharbor/harbor

Feature request to export scan results both automated and from the UI

Open

#6683 opened on Jan 2, 2019

View on GitHub
 (5 comments) (11 reactions) (0 assignees)Go (28,490 stars) (5,235 forks)batch import
area/vulnerability-scanhelp wantedkind/requirement

Description

Is your feature request related to a problem? Please describe. Security team is asking for reports to track when a security vulnerability was detected in addition to what has been detected.

Describe the solution you'd like Export the scanning results for all images which can be done via the UI on demand. Also options for the scanning report to be sent to and email ever so often. I.E hourly, daily or weekly report that shows all the images, current vulnerabilities detected, last scan and last each of the CVE data sources were updated.

Additional context Bug 2262257

Contributor guide

Tech stack
godockerrest api
Domain
securitybackend
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
GoREST APIsBackground jobsEmail integration
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
35
Research direction
Start by exploring the existing scanning result export functionality in Harbor's API. Look at the scan controller and report models in the source code (e.g., src/controller/scan/). Review the current UI for any export buttons and the underlying API calls. Investigate Harbor's job service for scheduled tasks to understand how to implement periodic email reports. Check the referenced bug 2262257 for additional details. No linked PRs or maintainer comments specify concrete next steps, so focus on understanding the architecture.