Add --app-vulns flag only if no json output

Signed-off-by: Stefan Scherer <stefan.scherer@docker.com>

Author: StefanScherer

cmd/docker-scan/main.go

@@ -124,6 +124,8 @@ func configureProvider(ctx context.Context, dockerCli command.Cli, flags options
 		}
 	} else if flags.groupIssues {
 		return nil, fmt.Errorf("--json flag is mandatory to use --group-issues flag")
+	} else {
+		opts = append(opts, provider.WithAppVulns())
 	}
 	if flags.dockerFilePath != "" {
 		opts = append(opts, provider.WithDockerFile(flags.dockerFilePath))

internal/provider/provider.go

@@ -50,7 +50,7 @@ type Options struct {
 // NewProvider returns default provider options setup with the give options
 func NewProvider(options ...Ops) (Options, error) {
 	provider := Options{
-		flags: []string{"container", "test", "--app-vulns"},
+		flags: []string{"container", "test"},
 		out:   os.Stdout,
 		err:   os.Stderr,
 	}
@@ -151,6 +151,14 @@ func WithGroupIssues() Ops {
 	}
 }
 
+// WithAppVulns scans for applications vulnerabilities as well
+func WithAppVulns() Ops {
+	return func(provider *Options) error {
+		provider.flags = append(provider.flags, "--app-vulns")
+		return nil
+	}
+}
+
 // WithPath update the provider binary with the path from the configuration
 func WithPath(path string) Ops {
 	return func(provider *Options) error {