michealstevewaugh/Aqua Security Trivy

Scans container images for vulnerabilities with Trivy

Trust Signals

workflow.ymlSHA-pinned

uses: michealstevewaugh/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
scan-type	Scan type to use for scanning vulnerability	no	image
image-ref	image reference(for backward compatibility)	yes	—
input	reference of tar file to scan	no	""
scan-ref	Scan reference	no	.
exit-code	exit code when vulnerabilities were found	no	—
ignore-unfixed	ignore unfixed vulnerabilities	no	false
vuln-type	comma-separated list of vulnerability types (os,library)	no	os,library
severity	severities of vulnerabilities to be displayed	no	UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
format	output format (table, json, template)	no	table
template	use an existing template for rendering output (@/contrib/gitlab.tpl, @/contrib/junit.tpl, @/contrib/html.tpl)	no	""
output	writes results to a file with the specified file name	no	""
skip-dirs	comma separated list of directories where traversal is skipped	no	""
skip-files	comma separated list of files to be skipped	no	""
cache-dir	specify where the cache is stored	no	""
timeout	timeout (default 5m0s)	no	""
ignore-policy	filter vulnerabilities with OPA rego language	no	""
hide-progress	hide progress output	no	—
list-all-pkgs	output all packages regardless of vulnerability	no	false
security-checks	comma-separated list of what security issues to detect	no	""
trivyignores	comma-separated list of relative paths in repository to one or more .trivyignore files	no	""
artifact-type	input artifact type (image, fs, repo, archive) for SBOM generation	no	—
github-pat	GitHub Personal Access Token (PAT) for submitting SBOM to GitHub Dependency Snapshot API	no	—
trivy-config	path to trivy.yaml config	no	—

no outputs