lhotari/Sandboxed Trivy
Scans container images for vulnerabilities with Trivy running inside a sandboxed Docker container
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 14, 2026
- License
- Apache 2.0
Pinned Snippet
uses: lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0 # v1.0.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-type | Scan type to use for scanning vulnerability | no | image |
| scan-ref | Scan reference (image name or tar file for image scans, path for fs/config scans, URL for repo scans). Required unless trivy-config is provided. | no | "" |
| exit-code | exit code when vulnerabilities were found | no | — |
| ignore-unfixed | ignore unfixed vulnerabilities | no | false |
| vuln-type | comma-separated list of vulnerability types (os,library) | no | os,library |
| severity | severities of vulnerabilities to be displayed | no | UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL |
| format | output format (table, json, template) | no | table |
| template | use an existing template for rendering output (@/contrib/gitlab.tpl, @/contrib/junit.tpl, @/contrib/html.tpl) | no | "" |
| output | writes results to a file with the specified file name | no | "" |
| skip-dirs | comma separated list of directories where traversal is skipped | no | "" |
| skip-files | comma separated list of files to be skipped | no | "" |
| cache-dir | specify where the cache is stored | no | ${{ github.workspace }}/.cache/trivy |
| timeout | timeout (default 5m0s) | no | "" |
| ignore-policy | filter vulnerabilities with OPA rego language | no | "" |
| hide-progress | suppress progress bar and log output | no | — |
| list-all-pkgs | output all packages regardless of vulnerability | no | false |
| scanners | comma-separated list of what security issues to detect | no | "" |
| trivyignores | comma-separated list of relative paths within the repository to one or more .trivyignore files, or a single .trivyignore.yaml file. | no | "" |
| trivy-config | path to trivy.yaml config | no | — |
| limit-severities-for-sarif | limit severities for SARIF format | no | — |
| trivy-image | Docker image to use for running Trivy | no | aquasec/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c |
| docker-tar-dir | Directory for storing docker save tar files (for image scans). Uses a temp directory if empty. | no | "" |
| trivy-env | Newline-separated list of NAME=VALUE pairs for additional Trivy environment variables to pass into the sandboxed container | no | "" |
| cache | Used to specify whether caching is needed. Set to false, if you would like to disable caching. | no | true |
Outputs
no outputs