rad-security/RAD Image Scan

Scan container images for vulnerabilities and enrich the report with currently-deployed image data from RAD Security.

Trust Signals

workflow.ymlSHA-pinned

uses: rad-security/image-scan-action@1b5241828ede9c4a0a019f8a441e361f311b4d4e # v0.0.3

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
image	Image to scan (e.g. registry.example.com/foo/bar:v1). Required unless 'sbom' is set.	no	—
sbom	Path to a Syft JSON SBOM to scan instead of an image.	no	—
format	Output format passed to grype: table \| json \| sarif \| cyclonedx.	no	table
fail_on_severity	Fail the workflow if any vulnerability at this severity or higher is found. Values: negligible \| low \| medium \| high \| critical.	no	—
ignore_cves	Multiline list of CVE IDs to ignore. One per line.	no	—
rad_account_ids	Comma-separated RAD account IDs to query. Required for RAD enrichment. Without this input the action behaves as pure grype.	no	—
rad_fail_on_regression	Fail the workflow if the new scan adds vulnerabilities at this severity or higher vs any currently-deployed instance. Values: critical \| high \| medium \| low \| any.	no	—
rad_fail_on_eol	Set to 'true' to fail the workflow if the scanned image is built on an end-of-life distro.	no	—
rad_api_url	Override the RAD API base URL. Defaults to https://api.rad.security.	no	—
rad_report	Path where the RAD enrichment JSON report should be written.	no	rad-report.json
rad_annotate_sarif	When format=sarif, inject the RAD report under runs[].properties.rad.	no	true

name	description
sarif	Path to the SARIF report (only set when format=sarif).
rad_report	Path to the RAD enrichment JSON report (only set when RAD credentials are configured).