navikt/ONBUILD check
Check (and fail) if any of the base imagees contain Docker ONBUILD instructions (which is a potential supply chain attack vector)
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| dockerfile | Path to the Dockerfile. (default ./Dockerfile) | yes | Dockerfile |
| mode | 'audit' or 'enforce'. Should execution halt if ONBUILDs are found, or do we just log it? | no | enforce |
Outputs
no outputs