tomtonic/grype_me

Scan repositories or artifacts with Anchore Grype; publish vulnerability badges and linked Markdown reports.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
scan	Scan a git ref in the repository. Mutually exclusive with image/path/sbom. - 'latest_release': (default) Scan the highest stable semver tag. Pre-release tags (e.g., v1.0.0-beta) are skipped. Ideal for nightly vulnerability scans of your latest published release. - 'head': Scan the current working directory as checked out (no git operations). Use this for PR checks or when you control the checkout. - A tag/branch name: Scan a specific git ref. Note: For latest_release, tags are sorted by semantic version, not date.	no	""
image	Container image to scan (e.g., 'myapp:latest', 'ghcr.io/org/app:v1.2.3'). The image must be available locally (pulled or built) or in a registry. Mutually exclusive with scan/path/sbom.	no	""
image-source	Optional Grype image source for `image` scans. Use `registry` to pull directly from a registry without Docker daemon access. Other values: `docker`, `podman`, `containerd`, `auto`. Default: `auto` (Grype implicit behavior, typically Docker daemon first).	no	auto
path	Directory or file path to scan (e.g., '.', './dist', './target/app.jar'). Grype auto-detects the content type (go.mod, package.json, JAR, etc.). Mutually exclusive with scan/image/sbom.	no	""
sbom	SBOM file to scan (Syft JSON, SPDX, or CycloneDX format). Generate with 'syft' or 'anchore/sbom-action' first. Mutually exclusive with scan/image/path.	no	""
fail-build	Fail the action if vulnerabilities are found at or above severity-cutoff.	no	false
severity-cutoff	Minimum severity to trigger a failure when fail-build is true. One of: negligible, low, medium, high, critical.	no	medium
output-file	Path to save grype's JSON scan results (optional)	no	""
only-fixed	Only report vulnerabilities that have a fix available.	no	false
db-update	Update the vulnerability database before scanning. The image ships with a pre-downloaded DB (max 24h old). Set to 'true' for critical scans requiring the absolute latest data. Default: 'false' (use built-in DB).	no	false
debug	Enable debug output (prints environment variables when true). Warning: may expose sensitive data in logs.	no	false
strict-privilege-drop	Enforce non-root execution strictly. If true, the action fails when GITHUB_OUTPUT cannot be pre-opened before dropping to UID/GID 10001. If false (default), the action falls back to root with a warning to preserve workflow reliability.	no	false
description	Optional free-text description of what was scanned. Supports arbitrary text including Markdown formatting and line breaks. Included verbatim in the generated Markdown report under "Description:".	no	""
gist-token	A GitHub personal access token (classic) with 'gist' scope. Required for uploading the badge JSON and scan report to a gist. Store as a repository secret (e.g., secrets.GIST_TOKEN).	no	""
gist-id	The ID of the gist to update with badge JSON and scan report. Create a gist manually, then copy the ID from the URL (e.g., https://gist.github.com/user/<this-id>). Required when gist-token is set.	no	""
gist-filename	Base filename for files stored in the gist. The action will create three files: '<name>.json' (shields.io endpoint), '<name>.md' (detailed scan report), and '<name>-grype.json' (raw grype output). If empty, the scan mode is used (e.g., 'grype-release.json').	no	""

Outputs

name	description
grype-version	Version of Grype used for scanning
db-version	Version of the Grype vulnerability database
cve-count	Total number of CVEs found
critical	Number of critical severity vulnerabilities
high	Number of high severity vulnerabilities
medium	Number of medium severity vulnerabilities
low	Number of low severity vulnerabilities
json-output	Path to the JSON output file (if output-file was specified)
badge-url	shields.io badge URL. When gist integration is configured, this is a dynamic endpoint badge pointing to the gist JSON. Otherwise, it is a static shields.io URL. Color indicates severity: green (none), yellowgreen (low), yellow (medium), orange (high), red (critical).
report-url	URL to the rendered Markdown scan report section in the gist (gist.github.com with file anchor). Anchor format follows GitHub's rendered file IDs (e.g., my_file.md -> #file-my_file-md). Only set when gist-token and gist-id are configured. Can be used as the badge link target so clicking the badge opens the full vulnerability report.
runtime-privilege	Runtime privilege mode used by the container. Values: already-non-root, dropped, or root-fallback.
runtime-privilege-detail	Diagnostic detail for runtime privilege handling. Non-empty when privilege drop cannot be performed because GITHUB_OUTPUT cannot be pre-opened before dropping privileges.