From e891e8cf14ba8f25f158d2bc277601eaf06ccfdf Mon Sep 17 00:00:00 2001 From: Yash Date: Mon, 7 Sep 2026 20:21:18 +0530 Subject: [PATCH] fix: explicitly handle exhausted Trivy retries This commit fixes a bug where exhausting all 10 Trivy retries would result in a confusing JSON parse error instead of the underlying execution error. It also cleans up a redundant condition inside the retry loop. Signed-off-by: Yash --- pkg/image/vulnerability_scan.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/image/vulnerability_scan.go b/pkg/image/vulnerability_scan.go index d24b07450..1a6d1d807 100644 --- a/pkg/image/vulnerability_scan.go +++ b/pkg/image/vulnerability_scan.go @@ -74,7 +74,7 @@ func RunVulnerabilityScan(ctx context.Context, imagePath string, settings builda // GET https://ghcr.io/v2/aquasecurity/trivy-db/manifests/2: TOOMANYREQUESTS: retry-after: 508.904┬Ás, allowed: 44000/minute // // FATAL Fatal error init error: DB error: failed to download vulnerability DB: OCI artifact error: failed to download vulnerability DB: failed to download artifact from any source - if i < 10 && strings.Contains(sResult, "failed to download vulnerability DB") { + if strings.Contains(sResult, "failed to download vulnerability DB") { log.Println("Will retry") time.Sleep(time.Second) } else { @@ -82,6 +82,12 @@ func RunVulnerabilityScan(ctx context.Context, imagePath string, settings builda } } + // All retry attempts were exhausted return the underlying Trivy error + // rather than falling through to json.Unmarshal with error output. + if err != nil { + return nil, fmt.Errorf("failed to run trivy: %w", err) + } + var trivyResult TrivyResult if err := json.Unmarshal(result, &trivyResult); err != nil { return nil, err