actions-marketplace-validations/Container image scan

Scan container images for vulnerabilities and CIS guidelines

Trust Signals

workflow.ymlSHA-pinned

uses: actions-marketplace-validations/azure_container-scan@99cfdbc2165777480795657ffb45ba4c26609109 # no releases — HEAD as of 2026-07-13

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
image-name	Docker image to scan	yes	—
severity-threshold	(Optional) Minimum severity threshold set to control flagging of the vulnerabilities found during the scan. The available levels are: (UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL); if you set the severity-threshold to be `MEDIUM` every CVE found of a level higher than or equal to `MEDIUM` would be displayed	no	HIGH
username	Username to authenticate to the Docker registry	no	—
password	Password to authenticate to the Docker registry	no	—
token	Github token	yes	${{ github.token }}
trivy-version	Version of Trivy to run	no	latest
run-quality-checks	Add additional checks to ensure the image is secure and follows best practices and CIS standards	no	true

name	description
scan-report-path	File path where the scan results are stored
check-run-url	URL of the check run. Overview about finding of vulnerabilities and best-practices.