docker/Docker Scout
List vulnerabilities in images; find better base images and upload an image SBOM to Docker Scout
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 3, 2026
- License
- None
Pinned Snippet
uses: docker/scout-action@2688993af7bafd6ba8c6a74ec652442be91dd82b # v1.23.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| command | Command(s) to run. Use a comma separated list to run several commands on the same set of parameters, for instance quickview,compare | yes | — |
| debug | Debug | no | — |
| verbose-debug | Print more verbose debug messages | no | — |
| summary | Publish the output as GitHub Action summary | no | true |
| organization | Namespace of the Docker organization | no | — |
| image | Image to analyze | no | — |
| platform | Platform of the image to analyze | no | — |
| ref | Ref if needed | no | — |
| to | Image to compare to | no | — |
| to-ref | Ref of image to compare | no | — |
| to-stream | Compare to image in stream | no | — |
| to-env | Compare to image in environment | no | — |
| to-latest | Compare to latest pushed image | no | — |
| stream | Name of the stream to record the image | no | — |
| environment | Name of the environment to record the image | no | — |
| hide-policies | Hide policies from the output altogether | no | — |
| policy-file | Path to a local .rego policy file to evaluate. Use a comma separated list to evaluate several files. | no | — |
| policy-dir | Path to a directory of local .rego policy files to evaluate. Use a comma separated list to evaluate several directories. | no | — |
| policy-bundle | OCI reference of a policy bundle to evaluate. Use a comma separated list to evaluate several bundles. | no | — |
| policy-config | Path to a JSON file configuring policy enablement and inputs | no | — |
| only-policy | Comma separated list of policies to evaluate | no | — |
| ignore-base | Ignore vulnerabilities from base image | no | — |
| ignore-unchanged | Filter out unchanged packages | no | — |
| only-vex-affected | Filter out CVEs that are marked not affected by a VEX statement | no | — |
| vex-author | List of VEX statement authors to accept | no | — |
| vex-location | File location of directory or file containing VEX statement | no | — |
| only-fixed | Filter to fixable CVEs | no | — |
| only-unfixed | Filter to unfixed CVEs | no | — |
| only-severities | Comma separated list of severities (critical, high, medium, low, unspecified) to filter CVEs by | no | — |
| only-package-types | Comma separated list of package types (like apk, deb, rpm, npm, pypi, golang, etc) | no | — |
| only-cisa-kev | Filter to CVEs listed in the CISA Known Exploited Vulnerabilities catalog | no | — |
| ignore-suppressed | Filter out CVEs affected by Scout suppressions | no | — |
| exit-code | Fail the action step if vulnerability changes are detected | no | — |
| exit-on | (compare only) Comma separated list of conditions to fail the action step if worsened, options are: vulnerability, policy | no | — |
| sarif-file | Write output to a SARIF file for further processing or upload into GitHub code scanning | no | — |
| only-refresh | Only display base image refresh recommendations | no | — |
| only-update | Only display base image update recommendations | no | — |
| format | Format of the SBOM to generate (json, list, spdx, cyclonedx) | no | json |
| output | Output file for the SBOM | no | — |
| secrets | Enable secret scanning as part of SBOM indexing | no | — |
| tags | List of tags to add to the attestation | no | — |
| file | File path to the attestation file | no | — |
| predicate-type | Predicate type of the attestation | no | — |
| referrer | Use OCI referrer API for pushing attestation | no | — |
| referrer-repository | Repository to push referrer to | no | — |
| registry-write-user | Registry user to push attestations | no | — |
| registry-write-password | Registry password to push attestations | no | — |
| dockerhub-user | Docker Hub User | no | — |
| dockerhub-password | Docker Hub PAT | no | — |
| registry-user | Registry user to pull images | no | — |
| registry-password | Registry password to pull images | no | — |
| github-token | GitHub Token to write comments | no | ${{ github.token }} |
| write-comment | Write the output as a Pull Request comment | no | true |
| keep-previous-comments | If set, keep but hide previous comment. If not set, keep and update one single comment per job | no | — |
Outputs
no outputs