steinsi/Docker Scout
List vulnerabilities in images; find better base images and upload an image SBOM to Docker Scout
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | Command(s) to run. Use a comma separated list to run several commands on the same set of parameters, for instance quickview,compare | yes | — |
| debug | Debug | no | — |
| verbose-debug | Print more verbose debug messages | no | — |
| summary | Publish the output as GitHub Action summary | no | true |
| organization | Namespace of the Docker organization | no | — |
| image | Image to analyze | no | — |
| platform | Platform of the image to analyze | no | — |
| ref | Ref if needed | no | — |
| to | Image to compare to | no | — |
| to-ref | Ref of image to compare | no | — |
| to-stream | Compare to image in stream | no | — |
| to-env | Compare to image in environment | no | — |
| to-latest | Compare to latest pushed image | no | — |
| stream | Name of the stream to record the image | no | — |
| environment | Name of the environment to record the image | no | — |
| hide-policies | Hide policies from the output altogether | no | — |
| ignore-base | Ignore vulnerabilities from base image | no | — |
| ignore-unchanged | Filter out unchanged packages | no | — |
| ignore-vex | Filter out CVEs that are marked not affected by a VEX statement | no | — |
| only-fixed | Filter to fixable CVEs | no | — |
| only-unfixed | Filter to unfixed CVEs | no | — |
| only-severities | Comma separated list of severities (critical, high, medium, low, unspecified) to filter CVEs by | no | — |
| only-package-types | Comma separated list of package types (like apk, deb, rpm, npm, pypi, golang, etc) | no | — |
| exit-code | Fail the action step if vulnerability changes are detected | no | — |
| exit-on | (compare only) Comma separated list of conditions to fail the action step if worsened, options are: vulnerability, policy | no | — |
| sarif-file | Write output to a SARIF file for further processing or upload into GitHub code scanning | no | — |
| format | Format of the SBOM to generate (json, list, spdx) | no | json |
| output | Output file for the SBOM | no | — |
| file | File path to the attestation file | no | — |
| predicate-type | Predicate type of the attestation | no | — |
| dockerhub-user | Docker Hub User | no | — |
| dockerhub-password | Docker Hub PAT | no | — |
| registry-user | Registry user to pull images | no | — |
| registry-password | Registry password to pull images | no | — |
| github-token | GitHub Token to write comments | no | ${{ github.token }} |
| write-comment | Write the output as a Pull Request comment | no | true |
| keep-previous-comments | If set, keep but hide previous comment. If not set, keep and update one single comment per job | no | — |
Outputs
no outputs