telicent-oss/Grype Scan Action
This action scans a filesystem/SBOM/Container Image using Grype
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-ref | The reference to the filesystem path, SBOM file, or container image to scan | yes | — |
| scan-name | A unique name for the scan to disambiguate the Job Artifacts it creates from others created by the same workflow. Note that the given `scan-name` value will be sanitised to remove characters that are not permitted by the actions that consume this value. You can find the actual names used for the report files and artifacts in the action output. | yes | — |
| scan-type | Specifies the kind of grype scan to perform, one of `image`, `fs` or `sbom`. Other values are not currently supported and will cause the action to fail. | yes | — |
| remote-vex | Specifies a new line separated list of remote repositories whose VEX statements should be retrieved via sparse checkout of their .vex/ directory. These VEX statements will be used to augment any local VEX statements in the .vex/ directory when scanning for vulnerabilities. | no | "" |
| gh-token | A GitHub Token needed to determine the current grype database version for caching. Defaults to `github.token` which is the token for this build, can be overridden if this default token doesn't work for your build environment. | no | ${{ github.token }} |
| gh-user | A GitHub User to use when cloning remote repositories to retrieve remote VEX statements. Defaults to `github.actor` which is the user running the build, can be overridden if this default user does not match the user who owns the `gh-token` input e.g. if providing a custom GitHub Token to retrieve VEX statements from private repositories. | no | ${{ github.actor }} |
| allow-unfixed | Specifies whether it is permitted for the action to pass if it detects High/Critical vulnerabilities that do not currently have a fix i.e. there is not necessarily anything we could do to resolve them at this time. | no | false |
| grype-version | Specifies the version of Grype to be installed and used without the leading `v` | no | 0.107.0 |
Outputs
| name | description |
|---|---|
| scan-results | The name of a GitHub Actions Artifact that has been uploaded by this action and contains the full Grype JSON scan results generated by the Grype scan. |
| scan-results-file | The name of the Grype JSON results file contained in the uploaded GitHub Actions artifact. |
| scan-results-url | The URL of the GitHub Actions Artifact that has been uploaded by this action and contains the full Grype JSON scan results generated by the Grype Scan. |