git.stella-ops.org/docs/events/samples/scanner.event.scan.completed@1.sample.json

{
  "eventId": "08a6de24-4a94-4d14-8432-9d14f36f6da3",
  "kind": "scanner.event.scan.completed",
  "version": 1,
  "tenant": "tenant-alpha",
  "occurredAt": "2025-10-19T12:34:56+00:00",
  "recordedAt": "2025-10-19T12:34:57+00:00",
  "source": "scanner.webservice",
  "idempotencyKey": "scanner.event.scan.completed:tenant-alpha:report-abc",
  "correlationId": "report-abc",
  "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
  "scope": {
    "namespace": "acme/edge",
    "repo": "api",
    "digest": "sha256:feedface"
  },
  "payload": {
    "reportId": "report-abc",
    "scanId": "report-abc",
    "imageDigest": "sha256:feedface",
    "verdict": "fail",
    "summary": {
      "total": 1,
      "blocked": 1,
      "warned": 0,
      "ignored": 0,
      "quieted": 0
    },
    "delta": {
      "newCritical": 1,
      "kev": [
        "CVE-2024-9999"
      ]
    },
    "policy": {
      "revisionId": "rev-42",
      "digest": "digest-123"
    },
    "findings": [
      {
        "id": "finding-1",
        "severity": "Critical",
        "cve": "CVE-2024-9999",
        "purl": "pkg:docker/acme/edge-api@sha256-feedface",
        "reachability": "runtime"
      }
    ],
    "links": {
      "report": {
        "ui": "https://scanner.example/ui/reports/report-abc",
        "api": "https://scanner.example/api/v1/reports/report-abc"
      },
      "policy": {
        "ui": "https://scanner.example/ui/policy/revisions/rev-42",
        "api": "https://scanner.example/api/v1/policy/revisions/rev-42"
      },
      "attestation": {
        "ui": "https://scanner.example/ui/attestations/report-abc",
        "api": "https://scanner.example/api/v1/reports/report-abc/attestation"
      }
    },
    "dsse": {
      "payloadType": "application/vnd.stellaops.report+json",
      "payload": "eyJyZXBvcnRJZCI6InJlcG9ydC1hYmMiLCJpbWFnZURpZ2VzdCI6InNoYTI1NjpmZWVkZmFjZSIsImdlbmVyYXRlZEF0IjoiMjAyNS0xMC0xOVQxMjozNDo1NiswMDowMCIsInZlcmRpY3QiOiJibG9ja2VkIiwicG9saWN5Ijp7InJldmlzaW9uSWQiOiJyZXYtNDIiLCJkaWdlc3QiOiJkaWdlc3QtMTIzIn0sInN1bW1hcnkiOnsidG90YWwiOjEsImJsb2NrZWQiOjEsIndhcm5lZCI6MCwiaWdub3JlZCI6MCwicXVpZXRlZCI6MH0sInZlcmRpY3RzIjpbeyJmaW5kaW5nSWQiOiJmaW5kaW5nLTEiLCJyZWFjaGFiaWxpdHkiOiJydW50aW1lIiwic2NvcmUiOjQ3LjUsInNvdXJjZVRydXN0IjoiTlZEIiwic3RhdHVzIjoiQmxvY2tlZCJ9XSwiaXNzdWVzIjpbXSwic3VyZmFjZSI6eyJ0ZW5hbnQiOiJ0ZW5hbnQtYWxwaGEiLCJnZW5lcmF0ZWRBdCI6IjIwMjUtMTAtMTlUMTI6MzQ6NTYrMDA6MDAiLCJtYW5pZmVzdERpZ2VzdCI6InNoYTI1Njo0ZmVlODdkMTg2MjkxZGRmYmJjYzJjNTZjOGVkMGU4Mjg1MjBiOGY1MmUxY2RlMGUxM2JiYTA4MmYxMDkxOGQ3IiwibWFuaWZlc3RVcmkiOiJjYXM6Ly9zY2FubmVyLWFydGlmYWN0cy9zY2FubmVyL3N1cmZhY2UvbWFuaWZlc3RzL3RlbmFudC1hbHBoYS9zaGEyNTYvNGYvZWUvNGZlZTg3ZDE4NjI5MWRkZmJiY2MyYzU2YzhlZDBlODI4NTIwYjhmNTJlMWNkZTBlMTNiYmEwODJmMTA5MThkNy5qc29uIiwibWFuaWZlc3QiOnsic2NoZW1hIjoic3RlbGxhb3BzLnN1cmZhY2UubWFuaWZlc3RAMSIsInRlbmFudCI6InRlbmFudC1hbHBoYSIsImltYWdlRGlnZXN0Ijoic2hhMjU2OmZlZWRmYWNlIiwiZ2VuZXJhdGVkQXQiOiIyMDI1LTEwLTE5VDEyOjM0OjU2KzAwOjAwIiwiYXJ0aWZhY3RzIjpbeyJraW5kIjoiZW50cnktdHJhY2UiLCJ1cmkiOiJjYXM6Ly9zY2FubmVyLWFydGlmYWN0cy9zY2FubmVyL2VudHJ5LXRyYWNlL2YwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwL2VudHJ5LXRyYWNlLmpzb24iLCJkaWdlc3QiOiJzaGEyNTY6ZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMGYwZjBmMCIsIm1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL2pzb24iLCJmb3JtYXQiOiJqc29uIiwic2l6ZUJ5dGVzIjo0MDk2fSx7ImtpbmQiOiJzYm9tLWludmVudG9yeSIsInVyaSI6ImNhczovL3NjYW5uZXItYXJ0aWZhY3RzL3NjYW5uZXIvaW1hZ2VzL2ZlZWRmYWNlL3Nib20uY2R4Lmpzb24iLCJkaWdlc3QiOiJzaGEyNTY6MTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMSIsIm1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5jeWNsb25lZHgranNvbjt2ZXJzaW9uPTEuNjt2aWV3PWludmVudG9yeSIsImZvcm1hdCI6ImNkeC1qc29uIiwic2l6ZUJ5dGVzIjoyNDU3NiwidmlldyI6ImludmVudG9yeSJ9LHsia2luZCI6InNib20tdXNhZ2UiLCJ1cmkiOiJjYXM6Ly9zY2FubmVyLWFydGlmYWN0cy9zY2FubmVyL2ltYWdlcy9mZWVkZmFjZS9zYm9tLXVzYWdlLmNkeC5qc29uIiwiZGlnZXN0Ijoic2hhMjU2OjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIiLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuY3ljbG9uZWR4K2pzb247dmVyc2lvbj0xLjY7dmlldz11c2FnZSIsImZvcm1hdCI6ImNkeC1qc29uIiwic2l6ZUJ5dGVzIjoxNjM4NCwidmlldyI6InVzYWdlIn1dfX19",
      "signatures": [
        {
          "keyId": "test-key",
          "algorithm": "hs256",
          "signature": "signature-value"
        }
      ]
    },
    "report": {
      "reportId": "report-abc",
      "imageDigest": "sha256:feedface",
      "generatedAt": "2025-10-19T12:34:56+00:00",
      "verdict": "blocked",
      "policy": {
        "revisionId": "rev-42",
        "digest": "digest-123"
      },
      "summary": {
        "total": 1,
        "blocked": 1,
        "warned": 0,
        "ignored": 0,
        "quieted": 0
      },
      "verdicts": [
        {
          "findingId": "finding-1",
          "reachability": "runtime",
          "score": 47.5,
          "sourceTrust": "NVD",
          "status": "Blocked"
        }
      ],
      "issues": [],
      "surface": {
        "tenant": "tenant-alpha",
        "generatedAt": "2025-10-19T12:34:56+00:00",
        "manifestDigest": "sha256:4fee87d186291ddfbbcc2c56c8ed0e828520b8f52e1cde0e13bba082f10918d7",
        "manifestUri": "cas://scanner-artifacts/scanner/surface/manifests/tenant-alpha/sha256/4f/ee/4fee87d186291ddfbbcc2c56c8ed0e828520b8f52e1cde0e13bba082f10918d7.json",
        "manifest": {
          "schema": "stellaops.surface.manifest@1",
          "tenant": "tenant-alpha",
          "imageDigest": "sha256:feedface",
          "generatedAt": "2025-10-19T12:34:56+00:00",
          "artifacts": [
            {
              "kind": "entry-trace",
              "uri": "cas://scanner-artifacts/scanner/entry-trace/f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0/entry-trace.json",
              "digest": "sha256:f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0",
              "mediaType": "application/json",
              "format": "json",
              "sizeBytes": 4096
            },
            {
              "kind": "sbom-inventory",
              "uri": "cas://scanner-artifacts/scanner/images/feedface/sbom.cdx.json",
              "digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
              "mediaType": "application/vnd.cyclonedx+json;version=1.6;view=inventory",
              "format": "cdx-json",
              "sizeBytes": 24576,
              "view": "inventory"
            },
            {
              "kind": "sbom-usage",
              "uri": "cas://scanner-artifacts/scanner/images/feedface/sbom-usage.cdx.json",
              "digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
              "mediaType": "application/vnd.cyclonedx+json;version=1.6;view=usage",
              "format": "cdx-json",
              "sizeBytes": 16384,
              "view": "usage"
            }
          ]
        }
      }
    }
  },
  "attributes": {
    "policyDigest": "digest-123",
    "policyRevisionId": "rev-42",
    "reportId": "report-abc",
    "verdict": "blocked"
  }
}