thadiust/Trivy scan (repo or image)
Run Trivy filesystem and/or config on a checkout, or scan a container image already in the local Docker daemon; counts findings and optionally writes SARIF
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| scan_kind | filesystem = trivy fs/config on paths under working_directory; image = trivy image IMAGE_REF (Docker daemon must have the image loaded) | no | filesystem |
| image_ref | Docker image reference to scan when scan_kind is image (e.g. workflow-python-ci:scan) | no | "" |
| trivy_version | Exact Trivy release version (no v prefix); must exist on aquasecurity/trivy releases | no | 0.69.3 |
| working_directory | Directory to scan (repo root relative) | no | . |
| mode | Which scans to run: fs, config, or both | no | both |
| paths | Space-separated paths to scan (relative to working_directory) | no | . |
| severity | Comma-separated severities to include (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) | no | HIGH,CRITICAL |
| ignore_unfixed | If true, ignore vulnerabilities without a fix | no | true |
| fail_on_findings | Fail the action when one or more findings are reported | no | true |
| write_sarif | Write a SARIF 2.1 report to sarif_filename (for GitHub Code Scanning upload) | no | false |
| sarif_filename | SARIF file path relative to working_directory (used when write_sarif is true) | no | trivy-results.sarif |
Outputs
| name | description |
|---|---|
| finding_count | Total number of findings (vulnerabilities + misconfigurations + secrets, depending on scan mode) |
| scan_status | Final scan status (clean, findings_found, scanner_error) |
| sarif_path | Repo-relative path to the SARIF report when write_sarif is true (empty otherwise) |