anchore/Anchore Container Scan
Scan docker containers with Grype for vulnerabilities
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 6–8scored Jul 6, 2026
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- MIT
Pinned Snippet
uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| image | The image to scan. This option is mutually exclusive with "path" and "sbom". | no | — |
| path | The path to scan. This option is mutually exclusive with "image" and "sbom". | no | — |
| sbom | The SBOM file to scan. This option is mutually exclusive with "path" and "image". | no | — |
| fail-build | Set to false to avoid failing based on severity-cutoff. Default is to fail when severity-cutoff is reached (or surpassed) | no | true |
| output-format | Set the output parameter after successful action execution. Valid choices are "json", "sarif", "cyclonedx", "cyclonedx-json" and "table". | no | sarif |
| output-file | The file to output the grype scan results to | no | — |
| severity-cutoff | Optionally specify the minimum vulnerability severity to trigger an "error" level ACS result. Valid choices are "negligible", "low", "medium", "high" and "critical". Any vulnerability with a severity less than this value will lead to a "warning" result. Default is "medium". | no | medium |
| only-fixed | Specify whether to only report vulnerabilities that have a fix available. Default is false. | no | false |
| add-cpes-if-none | Specify whether to autogenerate missing CPEs. Default is false. | no | false |
| by-cve | Specify whether to orient results by CVE rather than GHSA. Default is false. | no | false |
| grype-version | A specific version of Grype to install | no | — |
| vex | Specify a list of VEX documents to consider when producing scanning results. | no | — |
| config | Specify one or more Grype configuration files (newline-separated). Setting this will disable auto-detection of configuration files (e.g. .grype.yaml) - only the specified files will be loaded. | no | — |
| cache-db | Cache the Grype DB in GitHub action cache and restore before checking for updates | no | — |
Outputs
| name | description |
|---|---|
| sarif | Path to a SARIF report file for the scan |
| json | Path to a JSON report file for the scan |
| cyclonedx-xml | Path to a CycloneDX XML report file for the scan |
| cyclonedx-json | Path to a CycloneDX JSON report file for the scan |