Reconcile ignores and send a single grouped notification

.gitea/workflows/build-scan-push.yml

@@ -30,67 +30,34 @@ jobs:
         uses: https://git.sysmd.uk/mdaleo404/actions/scan-image@v1
         with:
           image: ${{ env.IMAGE }}
-      - name: Notify Node-RED on vulnerabilities
-        if: steps.scan.outcome == 'failure'
+          fail-on-fixable: 'false'
+      - name: Reconcile Grype ignores
+        id: reconcile
+        continue-on-error: true
+        env:
+          GITEA_TOKEN: ${{ secrets.AUTOUPDATE_TOKEN }}
         run: |
-          jq '
-          {
-            repo: "mdaleo404/games",
-            image: "'${IMAGE}'",
-            summary: (
-              "Total: " +
-              (
-                [
-                  .matches[]
-                  | select(
-                      (
-                        .vulnerability.severity == "High" or
-                        .vulnerability.severity == "Critical"
-                      )
-                      and
-                      (
-                        (.vulnerability.fix.versions | length) > 0
-                      )
-                    )
-                ] | length | tostring
-              )
-            ),
-            vulnerabilities: [
-              .matches[]
-              | select(
-                  (
-                    .vulnerability.severity == "High" or
-                    .vulnerability.severity == "Critical"
-                  )
-                  and
-                  (
-                    (.vulnerability.fix.versions | length) > 0
-                  )
-                )
-              | {
-                library: .artifact.name,
-                cve: .vulnerability.id,
-                severity: .vulnerability.severity,
-                installed: .artifact.version,
-                fixed: (.vulnerability.fix.versions[0]),
-                title: .vulnerability.description,
-                url: .vulnerability.dataSource
-              }
-            ]
-          }
-          ' grype.json \
+          set -euo pipefail
+          curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" \
+            "https://git.sysmd.uk/api/v1/repos/Homelab/renovate-runner/raw/scripts/reconcile-grype.sh?ref=main" \
+            -o /tmp/reconcile-grype.sh
+          bash /tmp/reconcile-grype.sh
+      - name: Notify Node-RED on vulnerabilities
+        if: steps.reconcile.outcome == 'failure'
+        run: |
+          jq -n --arg repo "${GITHUB_REPOSITORY,,}" '{ repo: $repo }' \
           | curl -s -X POST https://nodered.sysmd.uk/vulns-alert \
               -H "Content-Type: application/json" \
               --data-binary @-
       - name: Fail workflow if vulnerabilities found
-        if: steps.scan.outcome == 'failure'
+        if: steps.reconcile.outcome == 'failure'
         run: exit 1
       - name: Push image
-        if: steps.scan.outcome != 'failure'
+        if: steps.reconcile.outcome != 'failure'
         run: |
           docker push ${IMAGE}
       - name: Deploy to server
-        if: steps.scan.outcome != 'failure'
+        if: steps.reconcile.outcome != 'failure'
         uses: appleboy/ssh-action@v1.2.0
         with:
           host: ${{ secrets.DEPLOYMENT_HOST }}