aquasecurity/Aqua Security Trivy
Scans container images for vulnerabilities with Trivy
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 2, 2026
- License
- Apache 2.0
Pinned Snippet
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-type | Scan type to use for scanning vulnerability | no | image |
| image-ref | image reference (for backward compatibility) | no | — |
| input | reference of tar file to scan | no | "" |
| scan-ref | Scan reference | no | . |
| exit-code | exit code when vulnerabilities were found | no | — |
| ignore-unfixed | ignore unfixed vulnerabilities | no | false |
| vuln-type | comma-separated list of vulnerability types (os,library) | no | os,library |
| severity | severities of vulnerabilities to be displayed | no | UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL |
| format | output format (table, json, template) | no | table |
| template | use an existing template for rendering output (@/contrib/gitlab.tpl, @/contrib/junit.tpl, @/contrib/html.tpl) | no | "" |
| output | writes results to a file with the specified file name | no | "" |
| skip-dirs | comma separated list of directories where traversal is skipped | no | "" |
| skip-files | comma separated list of files to be skipped | no | "" |
| cache-dir | specify where the cache is stored | no | ${{ github.workspace }}/.cache/trivy |
| timeout | timeout (default 5m0s) | no | "" |
| ignore-policy | filter vulnerabilities with OPA rego language | no | "" |
| hide-progress | suppress progress bar and log output | no | — |
| list-all-pkgs | output all packages regardless of vulnerability | no | false |
| scanners | comma-separated list of what security issues to detect | no | "" |
| trivyignores | comma-separated list of relative paths within the repository to one or more .trivyignore files, or a single .trivyignore.yaml file. | no | "" |
| github-pat | GitHub Personal Access Token (PAT) for submitting SBOM to GitHub Dependency Snapshot API | no | — |
| trivy-config | path to trivy.yaml config | no | — |
| tf-vars | path to terraform tfvars file | no | — |
| limit-severities-for-sarif | limit severities for SARIF format | no | — |
| docker-host | unix domain socket path to use for docker scanning, ex. unix:///var/run/docker.sock | no | — |
| version | Trivy version to use | no | v0.72.0 |
| cache | Used to specify whether caching is needed. Set to false, if you would like to disable caching. | no | true |
| skip-setup-trivy | skip calling the setup-trivy action to install trivy | no | false |
| token-setup-trivy | `token-setup-trivy` is required when `github.token` in invalid for `https://github.com` server. See https://github.com/aquasecurity/setup-trivy/?tab=readme-ov-file#install-trivy-with-non-default-token for more details. `token-setup-trivy` is only used to fetch the Trivy repository in `setup-trivy` | no | ${{ github.token }} |
Outputs
no outputs