orcasecurity/Orca Security - Container Image Scanning
Configures Orca CLI to run Container Image security scans
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 6–8scored Jul 6, 2026
- Maintenance Recency
- Stalelast commit Jan 1, 2025
- License
- Apache 2.0
Pinned Snippet
uses: orcasecurity/shiftleft-container-image-action@9cceca839ca144e6bb160a1d974d0656bcf71f22 # v1.0.6tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| api_token | Orca API Token used for Authentication | yes | — |
| exit_code | Exit code for failed execution due to policy violations | no | — |
| no_color | Disable color output | no | false |
| project_key | Project Key name | yes | — |
| silent | Disable logs and warnings output | no | false |
| disable_err_report | Suppress error reporting to the monitoring platform | no | false |
| disable_secret | Disables the secret detection scanning | no | false |
| hide_vulnerabilities | Do not show detailed view of the vulnerabilities findings | no | false |
| num_cpu | Number of logical CPUs to be used for secret scanning (default 10) | no | — |
| oci | Scan an OCI image | no | — |
| tar_archive | Scan a tar archived image. Input should be the path of the image .tar file | no | — |
| image | Container Image to scan | yes | — |
| format | Format for displaying the results | no | — |
| output | Output directory | no | — |
| control_timeout | Number of seconds the control has to execute before being canceled | no | — |
| ignore_failed_exec_controls | Ignore any failures that happened while executing any of the controls | no | — |
| timeout | Set the maximum duration for the CLI execution. valid time units ("s", "m", "h") | no | — |
| show_failed_issues_only | Show only failed issues in CLI results | no | false |
| exceptions_filepath | Exceptions YAML filepath. (File should be mounted) | no | — |
| custom_secret_controls | Path to custom secret controls file. | no | — |
| console_output | Prints results to console in the provided format (only when --output is provided) | no | — |
| config | Path to configuration file (json, yaml or toml) | no | — |
| show_annotations | Show github annotations on pull requests | no | true |
| skip_remote_lookup | Do not perform remote lookups for dependency information during the scan | no | false |
| display_name | Scan log display name (on Orca platform) | no | — |
| hide_skipped_vulnerabilities | filter out skipped vulnerabilities from result | no | false |
| max_secret | Set the maximum secrets that can be found, when reaching this number secret scan will stop | no | — |
| exclude_paths | List of paths to be excluded from scan (comma-separated). Example: './notToBeScanned/,example.tf' | no | — |
| dependency_tree | Show dependency origin tree of vulnerable packages | no | false |
| debug | Debug mode | no | false |
| disable_active_verification | Disable active verification | no | false |
| log_path | The directory path to specify where the logs should be written to on debug mode. Default to the current working directory | no | — |
| image_correlation_id | A unique identifier used to correlate an image across multiple scans, enabling issue management in the Orca platform (e.g., dismissing or snoozing issues across scans). Use this flag when image names vary between scans. | no | — |
Outputs
| name | description |
|---|---|
| exit_code | The exit code of the scan |