fuj1g0n/SARIF Dockerfile Anchor
Anchor Microsoft Defender (MDVM) container-image SARIF findings to the Dockerfile lines that introduced the packages, so GitHub code scanning can show them as pull-request inline annotations and diff gates.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 2, 2026
- License
- Apache 2.0
Pinned Snippet
uses: fuj1g0n/sarif-dockerfile-anchor@345bc59da43a10e9deb91461801a84d62dc31ea0 # v0.3.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| sarif | Path to the Defender CLI image-scan SARIF file. | yes | — |
| sbom | Path to the CycloneDX SBOM JSON file. | yes | — |
| dockerfile | Path to the Dockerfile to anchor findings to. | yes | Dockerfile |
| base-severity | Comma-separated severities of base-image OS findings kept as inline annotations. | no | high,critical |
| link-transitive | Anchor transitive OS dependencies to the install line of the nearest package that pulled them in (via the SBOM dependency graph). When false, such findings fall back to the base FROM line. | no | true |
| dockerfile-uri | Repo-relative URI written into the SARIF artifactLocation (default: value of dockerfile). | no | "" |
| output | Path to write the enriched SARIF (must be a file so it can be uploaded). | no | enriched.sarif |
| github-token | Token used to download release assets when pinned to a release tag. | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| sarif | Path to the enriched SARIF file. |