qasimnauman/Patch Docker Image

Scan, patch, and verify vulnerabilities using a Dockerfile input.

Trust Signals

name	description	required	default
dockerfile-path	Path to the Dockerfile to patch.	no	./Dockerfile
context-path	Optional build context path used with dockerfile-path.	no	.
build-args	Optional newline-separated build args (KEY=VALUE).	no	""
severities	Comma-separated severities to patch.	no	CRITICAL,HIGH,MEDIUM,LOW
patched-suffix	Suffix for patched image tag.	no	-patched
report-dir	Directory for reports and generated patch Dockerfile.	no	./vuln_reports
dry-run	Only generate artifacts and skip build, verify, push.	no	false
push	Push the verified patched image to the registry after a clean scan.	no	false
non-interactive	Fail instead of prompting when credentials are missing.	no	true
use-buildx	Use docker buildx for patched build.	no	false
python-version	Python version for running the tool.	no	3.12
dh-user	Docker Hub username used to authenticate Docker Scout.	no	""
dh-password	Docker Hub token or password used to authenticate Docker Scout.	no	""
create-pr	Open a pull request in the current repository containing the verified patch Dockerfile and a CVE summary table after a successful zero-CVE scan. Requires the calling workflow to have: permissions: contents: write pull-requests: write	no	false
pr-branch-prefix	Prefix for the auto-created patch branch name.	no	docker-security-patch

name	description
patched_image	The final verified patched image tag produced by the tool.
pr-url	URL of the pull request created (empty when create-pr is false or no CVEs were found).