eschercloudai/Build, Scan and Sign image using Trivy and Cosign
Generates a Docker image locally which will then be SBOM'd and scanned. The SBOM will be scanned and then the image will be scanned to ensure as clean an image as possible.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stalelast commit Dec 1, 2023
- License
- Apache 2.0
Pinned Snippet
uses: eschercloudai/container-security-action@21804e23d8da6793f7a592d074edf10d271ec08f # v0.0.4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| use-dockerhub | Set to true to use dockerhub. | no | — |
| image-repo | The repo to push the image to. | yes | — |
| repo-username | The username to log into the repo. | yes | — |
| repo-password | The password to log into the repo. | yes | — |
| image-name | The name of the image to build. | yes | — |
| add-latest-tag | Adds the latest tag to the build. | no | false |
| image-tag | The tag to build the image with - provide a matrix to build against multiple tags as each will need to be SBOM'd, scanned and signed independently. | yes | — |
| cosign-private-key | A private key with which to sign the image using cosign. | yes | — |
| cosign-password | The password to unlock the private key. | yes | — |
| cosign-tlog | Set to true to upload to tlog for transparency. | no | false |
| publish-image | If true the image will be published to the repo. | no | false |
| check-severity | A comma deliminated (uppercase) list of severities to check for. If found the pipeline will fail. Support values: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL | no | high |
| sbom-fail-on-detection | Must be 0 to succeed or any other number to fail if a severity is discovered at the `check-severity` level. This will be used as the exit code for the Trivy SBOM scan and 1 is recommended to differentiate it from the scan exit code. | no | 1 |
| scan-fail-on-detection | Must be 0 to succeed or any other number to fail if a severity is discovered at the `check-severity` level. This will be used as the exit code for the Trivy scan and 2 is recommended to differentiate it from the SBOM exit code. | no | 2 |
| trivyignore-file | Supply a Trivy ignore file to ignore specific CVEs and prevent a pipeline failure. | no | trivyignore |
| trivyignore-from-s3 | If disabled, the trivyignore can be supplied via the repo itself but actions/checkout@v4 must be used before calling this action. | no | false |
| aws-endpoint | If the endpoint isn't a standard AWS one, pass it in here. | no | https://some-s3-endpoint.com |
| aws-region | The AWS Region. | no | us-east-1 |
| aws-access-key | The S3 access key. | no | "" |
| aws-secret-key | The S3 secret key. | no | "" |
| s3-bucket | The S3 bucket in which the trivyignore file is stored. | no | trivy |
| s3-path | The path in the s3 bucket to the trivyignore file. | no | trivyignore |
| dockerfile-path | Path to the Dockerfile (default {context}/Dockerfile). | no | . |
| fail-build | Fail the build if the CVE severity level is found. | no | false |
Outputs
no outputs