Provide the default template under the templates path

[samueloph]

What would you like to be added:
I would love if the default template for the json output format was provided under the templates path: https://github.com/anchore/grype/tree/main/templates

Even better if all the other formats were provided there as examples too.

Why is this needed:
It makes it much easier to craft my own template as I can start from the json one and just remove the fields I don't want.

Additional context:

[willmurphyscode]

Thanks @samueloph! I've added needs-discussion so that we can talk at an upcoming community meeting about how best to implement this. Right now, there isn't a "default template," but rather Grype JSON serializes some golang structs.

I agree that it would be good change this to using a template so that it's less opaque to users, and we are hoping to stabilize and document the JSON output schema as we work towards grype 1.0, so this all seems to fit together nicely.

[willmurphyscode]

We discussed this at our livestream community gardening on 10 October 2024.

Some notes:

1. We do not want to write Go templating language that writes JSON - we want to stick to serializing Go structs natively
2. We would be interested in providing some query flags, like --fields and --filter, so subset Grype's output directly, without templating
3. We'd like to add a JSON schema document to Grype, and add some structs whose purpose is to be models used to serialize for the output as part of this.

@samueloph if you could run something like grype -o json --filter "severity>medium" --fields "package.type, vulnerability.fixed_in_versions" or something, would that meet your needs?

[samueloph]

@willmurphyscode

if you could run something like grype -o json --filter "severity>medium" --fields "package.type, vulnerability.fixed_in_versions" or something, would that meet your needs?

It would, my use case is that I'm running grype against roughly 300 different images constantly and I'm storing its results for metrics purposes.

Since I have to store so many results, I'm trying to redact some of the fields that I don't need, and I struggled a bit with understanding from which template to start with.

For reference, the workaround I'm doing right now is to json.loads the dict in my python script and then calling del to remove the fields for each report. It can be slightly costly because I need to iterate on the matches of each report (while iterating on each report), but it's saving me roughly 150MB of output for each run (I'm only doing the bare minimum filtering through the script).