aws-actions/Vulnerability Scan GitHub Action for Amazon Inspector

Generate SBOMs and scan for vulnerabilities in artifacts such as files, directories, containers, and more.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 9, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@f5a63f71de9d790c7c42da74d59efb2c017bdcac # v1.5.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
artifact_type	The artifact you would like to scan with Amazon Inspector. Valid choices are "repository", "container", "binary", or "archive".	yes	repository
artifact_path	Path to the artifact to scan. For repositories/files: relative path from project root (e.g., "./", "src/"). For containers: image reference that follows the docker pull convention: "NAME[:TAG\|@DIGEST]" (e.g., "alpine:latest") or path to saved tarball. For binaries/archives: file path relative to project root.	yes	./
platform	Specifies the OS and CPU arch of the container image you wish to scan. Valid inputs are of the form 'os/cpu/variant' for example, 'linux/amd64', 'linux/arm64/v8', etc. If no platform is specified, the system will use the same platform as the host that is performing the scan. This argument only affects container image scans. Requires inspector-sbomgen 1.5.1 or later.	no	—
sbomgen_version	The inspector-sbomgen version you wish to use for SBOM generation. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	no	latest
scanners	Specifies the file scanners that you would like inspector-sbomgen to execute. By default, inspector-sbomgen will try to run all file scanners that are applicable to the target artifact. If this argument is set, inspector-sbomgen will only execute the specified file scanners. Provide your input as a single string. Separate each file scanner with a comma. To view a list of available file scanners, execute 'inspector-sbomgen list-scanners'. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	no	''
skip_scanners	Specifies a list of file scanners that should NOT be executed; this argument cannot be combined with 'scanners'. If this argument is set, inspector-sbomgen will execute all file scanners except those you specified. Provide your input as a single string. Separate each file scanner with a comma. To view a list of available file scanners, execute 'inspector-sbomgen list-scanners'. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	no	''
additional_scanners	Enables additional (opt-in) file scanners that inspector-sbomgen does not run by default. Provide your input as a single string. Separate each file scanner with a comma. To view a list of available file scanners, execute 'inspector-sbomgen list-scanners'. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	no	''
skip_files	Specifies one or more files and/or directories that should NOT be inventoried. Separate each file with a comma and enclose the entire string in double quotes.	no	''
plugin_dir	Path to a directory containing custom Lua plugins for inspector-sbomgen to load (file discovery and package collection). The path is resolved inside the action container, so it should be within your checked-out workspace.	no	''
skip_nested_pomxml	If set to true, inspector-sbomgen will not collect dependencies declared in pom.xml files that are nested inside compiled jar archives.	no	false
timeout	Specifies a timeout in seconds. If this timeout is exceeded, the action will gracefully conclude and present any findings discovered up to that point.	no	600
max_file_size	Skip files larger than this many bytes during directory traversal. Set to 0 (the default) to disable the limit.	no	0
max_read_file_size	Cap a single buffered file read at this many bytes to prevent out-of-memory conditions. Set to 0 to disable the cap. -1 (the default) leaves inspector-sbomgen's built-in default in effect.	no	-1
depth	Limit directory traversal to the specified recursion depth. Set to -1 (the default) to leave inspector-sbomgen's built-in recursion behavior in effect.	no	-1
critical_threshold	Set 'vulnerability_threshold_exceeded' output to true if critical vulnerabilities found >= this number. Set to 0 to ignore critical vulnerabilities.	no	0
high_threshold	Set 'vulnerability_threshold_exceeded' output to true if critical vulnerabilities found >= this number. Set to 0 to ignore high vulnerabilities.	no	0
medium_threshold	Set 'vulnerability_threshold_exceeded' output to true if critical vulnerabilities found >= this number. Set to 0 to ignore medium vulnerabilities.	no	0
low_threshold	Set 'vulnerability_threshold_exceeded' output to true if critical vulnerabilities found >= this number. Set to 0 to ignore low vulnerabilities.	no	0
other_threshold	Set 'vulnerability_threshold_exceeded' output to true if critical vulnerabilities found >= this number. Set to 0 to ignore other vulnerabilities.	no	0
threshold_fixable_only	If set to true, only count vulnerabilities with a fix towards threshold exceeded condition.	no	false
display_vulnerability_findings	If set to "enabled", the action will display detailed vulnerability findings in the step summary page; see here for an example report: https://github.com/aws-actions/vulnerability-scan-github-action-for-amazon-inspector/actions/runs/8878213714	yes	disabled
show_only_fixable_vulns	If set to true, this action will show only fixed vulnerabilities in the GitHub Actions step summary page. All vulnerability metadata is still retained in the raw Inspector scan files.	no	false
license_collection	If set to true, inspector-sbomgen collects SPDX license metadata during SBOM generation and the action renders a license inventory report. License collection is supported for select ecosystems.	no	false
collect_ml_models	If set to true, inspector-sbomgen scans for machine learning models (e.g., Hugging Face) during SBOM generation.	no	false
enable_debug_props	If set to true, inspector-sbomgen adds debug properties to the SBOM (such as source file scanners and package collectors) to aid troubleshooting.	no	false
debug_file_paths	If set to true, inspector-sbomgen emits per-path directory-walk debug logging. Applies to repository/directory, archive, and volume scans.	no	false
ignore_findings	A comma-separated list of finding IDs to ignore. Ignored findings are excluded from reports and do not count towards vulnerability thresholds. You can also place an '.inspector-ignore' plain-text file (one ID per line, # for comments) at the root of your repository (the workflow's working directory).	no	''
output_sbom_path	The destination file path for the generated SBOM.	no	./sbom_${{ github.run_id }}.json
output_inspector_scan_path	The destination file path for Inspector's vulnerability scan (JSON format).	no	inspector_scan_${{ github.run_id }}.json
output_inspector_scan_path_csv	The destination file path for Inspector's vulnerability scan (CSV format).	no	inspector_scan_${{ github.run_id }}.csv
output_inspector_scan_path_markdown	The destination file path for Inspector's vulnerability scan (markdown format).	no	inspector_scan_${{ github.run_id }}.md
output_sarif_path	The destination file path for Inspector's vulnerability scan (SARIF format). SARIF is generated only when this value is set. Provide the resulting file to github/codeql-action/upload-sarif to publish findings to GitHub Code Scanning.	no	""
output_inspector_dockerfile_scan_path_csv	The destination file path for Inspector's Dockerfile vulnerability scan (CSV format).	no	inspector_dockerfile_scan_${{ github.run_id }}.csv
output_inspector_dockerfile_scan_path_markdown	The destination file path for Inspector's Dockerfile vulnerability scan (markdown format).	no	inspector_dockerfile_scan_${{ github.run_id }}.md
output_inspector_malware_scan_path_markdown	The destination file path for Inspector's malware (known-compromised package) findings (markdown format).	no	inspector_malware_scan_${{ github.run_id }}.md
output_license_report_path_csv	The destination file path for the collected license inventory (CSV format).	no	inspector_license_report_${{ github.run_id }}.csv
output_license_report_path_markdown	The destination file path for the collected license inventory (markdown format).	no	inspector_license_report_${{ github.run_id }}.md

Outputs

name	description
artifact_sbom	The filepath to the artifact's software bill of materials.
inspector_scan_results	The file path to the Inspector vulnerability scan findings in JSON format.
inspector_scan_results_csv	The file path to the Inspector vulnerability scan findings in CSV format.
inspector_scan_results_markdown	The file path to the Inspector vulnerability scan findings in markdown format.
inspector_scan_results_sarif	The file path to the Inspector vulnerability scan findings in SARIF format. Only set when 'output_sarif_path' was provided. Pass this to github/codeql-action/upload-sarif to publish findings to GitHub Code Scanning.
inspector_dockerile_scan_results_csv	The file path to the Inspector Dockerfile vulnerability scan findings in CSV format.
inspector_dockerile_scan_results_markdown	The file path to the Inspector Dockerfile vulnerability scan findings in markdown format.
inspector_malware_scan_results_markdown	The file path to the Inspector malware (known-compromised package) findings in markdown format.
inspector_license_results_csv	The file path to the collected license inventory in CSV format. Produced only when license_collection is enabled.
inspector_license_results_markdown	The file path to the collected license inventory in markdown format. Produced only when license_collection is enabled.
vulnerability_threshold_exceeded	This variable is set to 1 if any vulnerability threshold was exceeded, otherwise it is 0. This variable can be used to trigger custom logic, such as failing the job if vulnerabilities were detected.