smartdatafoundry/Trivy Security Scan
Comprehensive Docker image security scanning with Trivy, including vulnerability reporting and PR comments
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| image-ref | Docker image reference to scan (e.g., ghcr.io/user/repo:tag) | yes | — |
| registry | Container registry URL | no | ghcr.io |
| severity | Comma-separated list of severities to scan for | no | CRITICAL,HIGH |
| detailed-severity | Comma-separated list of severities for detailed JSON report | no | CRITICAL,HIGH,MEDIUM,LOW |
| ignore-unfixed | Ignore vulnerabilities with no available fix | no | true |
| exit-code | Exit code when vulnerabilities are found | no | 0 |
| artifact-name | Name for the artifact containing scan results | no | trivy-scan-results |
| artifact-retention-days | Number of days to retain the scan results artifact | no | 30 |
| github-token | GitHub token for commenting on PRs | no | ${{ github.token }} |
| post-pr-comment | Whether to post scan results as PR comment | no | true |
Outputs
| name | description |
|---|---|
| scan-status | Status of the security scan (success or vulnerabilities_found) |
| vulnerability-count | Total number of vulnerabilities found |
| artifact-id | ID of the uploaded artifact containing scan results |