This template is **ONLY** used for reporting bugs. New feature request or pipeline enhancement issues should use the other template options for issue submission. ## Current Behavior When querying the VAT, the pipeline is using the image_name which is pulled from the hardening_manifest.yaml, but when the pipeline is inserting/updating in the VAT db, the predefined CI variables `CI_PROJECT_PATH` is used. This causes the pipeline to fail when attempting to query the approval status of a container on master branches, because the query doesn't match any records in the VAT. After doing some investigation, we've discovered that for 55 projects, the project name and the image name in the hardening manifest do not match. [mismatching_names.json](/uploads/cb493f10d54abda54addaeb17cdb9c5b/mismatching_names.json) <!--- What happens instead of the expected behavior? --> ## Live Example https://repo1.dso.mil/dsop/cloudfit/cloudfit/cloudfit-cfs-exchangewebservices/-/jobs/2052884#L32 <!--- Provide a link to a live example(s) of the bug --> ## Expected Behavior When inserting/updating the VAT db, we should be using the image_name pulled from the hardening_manifest. <!--- What should happen instead? --> ## Possible Solution This is the solution we proposed to the VAT team. - Short Term: Check if manifest image_name and project_path match before querying. If yes use hm image_name, if no use project path. - Long Term: Revert short term solution and use hardening_manifest.yaml image_name for the vat import. Work with Irma and other VAT team members to ensure the data is migrated before this change is merged so no approvals are lost when changing the name for an image in VAT. <!--- Not required, but suggest a fix/reason for the bug --> Short Term Checklist - [x] Update check-cves and csv-output to check if project path and hm image name match - [ ] if yes use image name for vat query - [ ] if no use project path for vat query - [ ] For parent images, get project path and image name - [ ] if they match, use image name for vat query - [ ] if they don't match, use project path for vat query, query the vat - [ ] if no, fail the pipeline and log error message