dentsusoken/Build and Scan Image
Build and scan Dockerfile and container image by hadolint, dockle, trivy, docker scan
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 5, 2026
- License
- MIT
Pinned Snippet
uses: dentsusoken/build-and-scan-image@95053b1578413da2701399eada6b0abbe9834565 # v0.6.3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| tag | Image name and optionally tag in "name:tag" format | yes | — |
| path | Path to base directory to run `docker build` command (default ".") | no | . |
| dockerfile | Path to Dockerfile, which is relative path from "path" parameter (default "Dockerfile") | no | Dockerfile |
| hadolint-enable | Enable scanning Dockerfile by hadolint (default "true") | no | true |
| hadolint-version | Hadolint version. | no | 2.12.0 |
| hadolint-severity | Fail step if rules with a severity above this level are violated. Acceptable value is one of (error|warning|info|style|ignore|none). (default "info") | no | info |
| dockle-enable | Enable scanning image by dockle (default "true") | no | true |
| dockle-version | Dockle version. | no | 0.4.15 |
| dockle-severity | Fail step if checkpoints with a severity above this level are violated. Acceptable value is one of (INFO|WARN|FATAL). (default "WARN") | no | WARN |
| trivy-enable | Enable scanning image by trivy (default "true") | no | true |
| trivy-version | Trivy version. | no | 0.69.3 |
| trivy-severity | Fail step if image has vulnerabilities with a severity same as this level. Acceptable value is comma-separated list of (UNKNOWN|LOW|MEDIUM|HIGH|CRITICAL). (default "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL") | no | UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL |
| trivy-vuln-type | Vulnerability types which trivy detect to. Acceptable value is comma-separated list of (os|library). (default "os,library") | no | os,library |
| trivy-ignore-unfixed | Ignore unfixed vulnerabilities (default "false") | no | false |
| snyk-enable | Enable scanning image by snyk. If enabled, "snyk-token" must be also set. (default "false") | no | false |
| snyk-version | Snyk CLI version. | no | 1.1298.3 |
| snyk-token | Snyk API Token. This is necessary if "snyk-enable" is "true". (default "") | no | "" |
| snyk-severity | Fail step if image has vulnerabilities with a severity above this level. Acceptable value is one of (low|medium|high|critical). (default "low") | no | low |
| snyk-exclude-base-image-vulns | Exclude base image vulnerabilities (default "false") | no | false |
Outputs
no outputs