telicent-oss/Trivy Scan Action

This action scans a filesystem/SBOM/Container Image using Trivy

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
scan-ref	The reference to the filesytem path, SBOM file, or container image to scan	yes	—
scan-name	A unique name for the scan to disambiguate the Job Artifacts it creates from others created by the same workflow. Note that the given `scan-name` value will be sanitised to remove characters that are not permitted by the actions that consume this value. You can find the actual names used for the report files and artifacts in the action output.	yes	—
scan-type	Specifies the kind of Trivy scan to perform, one of `image`, `fs` or `sbom`. Other values are not currently supported and will cause the action to fail.	yes	—
remote-vex	Specifies a new line separated list of remote repositories whose VEX statements should be retrieved via sparse checkout of their .vex/ directory. These VEX statements will be used to augment any local VEX statements in the .vex/ directory when scanning for vulnerabilities.	no	""
gh-token	A GitHub Token needed to determine the current Trivy database version for caching. Defaults to `github.token` which is the token for this build, can be overridden if this default token doesn't work for your build environment.	no	${{ github.token }}
gh-user	A GitHub User to use when cloning remote repositories to retrieve remote VEX statements. Defaults to `github.actor` which is the user running the build, can be overridden if this default user does not match the user who owns the `gh-token` input e.g. if providing a custom GitHub Token to retrieve VEX statements from private repositories.	no	${{ github.actor }}
uses-java	Indicates whether the scan needs the Trivy Java Database available.	no	false
allow-unfixed	Specifies whether it is permitted for the action to pass if it detects High/Critical vulnerabilities that do not currently have a fix i.e. there is not necessarily anything we could do to resolve them at this time.	no	false
output-sbom	When specified this provides a filename prefix and the action will additionally output a CycloneDX JSON format SBOM based on the artifacts being scanned. Note that this filename will be combined with the provided `scan-name` input to ensure a unique filename. Please refer to the `sbom-file` output to find the actual output filename.	no	""

Outputs

name	description
scan-results	The name of a GitHub Actions Artifact that has been uploaded by this action and contains the full Trivy JSON scan results generated by the Trivy scan.
scan-results-file	The name of the Trivy JSON results file contained in the uploaded GitHub Actions artifact. This file will also exist in the `RUNNER_TEMP` directory for the duration of the calling job.
scan-results-url	The URL of the GitHub Actions Artifact that has been uploaded by this action and contains the full Trivy JSON scan results generated by the Trivy Scan.
sbom	The name of a GitHub Actions Artifact that has been uploaded by this action and contains a CycloneDX JSON format SBOM generated by Trivy.
sbom-file	The name of the SBOM file, this will be a combination of the `scan-name` and `output-sbom` inputs. This file will also exist in the `RUNNER_TEMP` directory for the duration of the calling job.
sbom-url	The URL of the GitHub Actions Artifact that has been uploaded by this action and contains the full Trivy generated CycloneDX JSON format SBOM.