jbenaventem/Aqua Security Trivy

Scans container images for vulnerabilities with Trivy

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stalelast commit Feb 27, 2022
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: jbenaventem/trivy-action@3bc46988b72a663cd18b4c8aa1a2eaa8277e3958 # no releases — HEAD as of 2026-07-11

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
scan-type	Scan type to use for scanning vulnerability	no	image
image-ref	image reference(for backward compatibility)	yes	—
input	reference of tar file to scan	no	""
scan-ref	Scan reference	no	.
exit-code	exit code when vulnerabilities were found	no	0
ignore-unfixed	ignore unfixed vulnerabilities	no	false
vuln-type	comma-separated list of vulnerability types (os,library)	no	os,library
severity	severities of vulnerabilities to be displayed	no	UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
format	output format (table, json, template)	no	table
template	use an existing template for rendering output (@/contrib/sarif.tpl, @/contrib/gitlab.tpl, @/contrib/junit.tpl	no	""
output	writes results to a file with the specified file name	no	""
skip-dirs	comma separated list of directories where traversal is skipped	no	""
skip-files	comma separated list of files to be skipped	no	""
cache-dir	specify where the cache is stored	no	""
timeout	timeout (default 5m0s)	no	""
ignore-policy	filter vulnerabilities with OPA rego language	no	""
hide-progress	hide progress output	no	true
list-all-pkgs	output all packages regardless of vulnerability	no	false

Outputs

no outputs