Inventory packages on Azure and GCE root volumes

[om986]

Summary

• Add om scan workload azure and om scan workload gcp for Phase 4 (#103). Each runs as root on a VM in that subscription or project, snapshots Linux OS disks in the same region, mounts the copy read-only, and writes CPE 2.3 names and package URLs onto the existing workload.
• om scan azure and om scan gcp stay read-only API scans. A later API scan keeps packages. Snapshots and disks are deleted when the read finishes, including on failure.
• Windows, LVM, ephemeral Azure OS disks, unmanaged VHDs, GCE local SSDs, customer-supplied keys, and data disks are skipped. The graph stores package identifiers only.

Test plan

• go test ./internal/workload/... ./internal/cmd/ ./internal/collectors/azure/ ./internal/collectors/gcp/
• On an Azure VM, run om scan azure, then sudo -E ./om scan workload azure, then om enrich cve, and confirm a CVE attaches only when an identifier matches
• On a GCE instance, run om scan gcp, then sudo -E ./om scan workload gcp, then om enrich cve
• Fail a read on purpose and confirm the snapshot and disk are deleted
• Run the API scan again and confirm packages are still on the workload
• Confirm a Windows VM and an LVM root are skipped

Made with Cursor

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: OpenSourceOM/core/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2fe9ee0e-cea9-4bad-b286-975a27f06378

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}