fix: do not check unmanaged resources

[nikpivkin]

Trivy creates dummy resources to store orphan resources, i.e. without parent resources. For example, if no related aws_security_group_rule resources are found for aws_security_group resources, Trivy will create a dummy group to store the rules. We should not be checking out dummy resources.

Discussed in #8044

^{Originally posted by obounaim December 4, 2024}

Description

I believe that Trivy is generating an incorrect SARIF file. This issue affects the ability to properly integrate the results into Github advanced security. This issue occurs when we scan GCP's Terraform resources.

Environment:

• Trivy version: v0.57.1
• Trivy Action version: 0.29

Github error:

Waiting for processing to finish
  Analysis upload status is pending.
  ##[debug]Analysis processing is still pending...
  Analysis upload status is failed.
  ::endgroup::
Error: Code Scanning could not process the submitted SARIF file:
locationFromSarifResult: expected artifact location, locationFromSarifResult: expected artifact location, locationFromSarifResult: expected artifact location, locationFromSarifResult: expected artifact location

Original Github Issue: 408
have noticed that some uri fields are missing from the SARIF file, could this be the cause of the upload problem? Example bellow :

       {
          "ruleId": "AVD-GCP-0061",
          "ruleIndex": 1,
          "level": "error",
          "message": {
            "text": "Artifact: \nType: terraform\nVulnerability AVD-GCP-0061\nSeverity: HIGH\nMessage: Cluster does not have master authorized networks enabled.\nLink: [AVD-GCP-0061](https://avd.aquasec.com/misconfig/avd-gcp-0061)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "message": {
                "text": ""
              }
            }
          ]
        },

Regards,

Desired Behavior

The generate SARIF should not get rejected by Github. It works for AWS Terraform resources, but when we scan GCP Terraform resources Github rejects the SARIF file.

Actual Behavior

The generate SARIF should not get rejected by Github. It works for AWS Terraform resources, but when we scan GCP Terraform resources Github rejects the SARIF file.

Reproduction Steps

1. Scan GCP terraform resources, and generate the results in a SARIF file
2. Upload the SARIF file to Github Advance Security

Target

None

Scanner

Misconfiguration

Output Format

SARIF

Mode

Standalone

Debug Output

The scanning works fine.

Operating System

Ubuntu 22.04.5

Version

v0.57.1

Checklist

• Run trivy clean --all
• Read the troubleshooting