uptycslabs/Uptycs Vulnerability Scanner
Scans containers for vulnerabilities and secrets
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| uptycs-secret | Tenant-specific secret for authenticating to uptycs | yes | — |
| image-id | ID of the docker image to scan for vulnerabilities | yes | — |
| hostname | The hostname of the uptycs stack to send results to | yes | — |
| fatal-cvss-score | The CVSS score at which a detected vulnerability should fail the build | no | 7.0 |
| custom-ca-cert | The path to a custom CA Cert to use for connecting to uptycs. | no | "" |
| vulnerabilities-enabled | Enable or disable vulnerability scanning. | no | true |
| secret-scanning-enabled | Enable or disable secret scanning. | no | true |
| malware-scanning-enabled | Enable or disable malware scanning. | no | true |
| secret-path | Path to scan for secrets. | no | — |
| malware-path | Path to scan for malware. | no | — |
| api-key | Tenant-specific key for authenticating to the uptycs API. Required if enabling grace-period. | no | — |
| api-secret | Tenant-specific secret for authenticating to the uptycs API. Required if enabling grace-period. | no | — |
| customer-id | Uptycs Customer ID. Required if enabling grace-period. | no | — |
| grace-period | Duration of time to allow vulnerabilities to remain in an image without failing a build. Example: `grace-period: "7d"`. | no | — |
| ignore-no-fix | Only report vulnerabilities for which fixes are available. | no | — |
| output-log-format | The format type to use when logging results to stdout. Valid values are 'json' and 'tab'. | no | — |
| output-format | The format type to use when writing reports to disk. Valid values are 'json' and 'csv'. | no | — |
| ignore-cve-file | Ignore any CVEs contained within the specified CSV file. | no | — |
| ignore-packages-file | Ignore vulnerabilities in packages specified within the specified CSV file. | no | — |
| ignore-no-exploit | Ignore any vulnerabilities for which no known exploits are available. | no | false |
| audit | Run an audit of the specified image but do not fail the build. | no | false |
| fatal-secret-severity | Severity level at which detected secrets will fail the build. | no | — |
| fatal-vulnerability-severity | Maximum allowable severity for a detected vulnerability. | no | — |
| vulnerability-log-minimum | Filter any vulnerabilities with a severity lower than the specified severity when logging results. | no | — |
| secret-log-minimum | Filter any secrets with a severity lower than the specified severity when logging results. | no | — |
| config-file | The path to the uptycs-ci configuration file to load. | no | — |
| policy-name | The name of the image assurance policy to apply to images scanned in this workflow. | no | — |
| uptycs-ci-image | The uptycs-ci image to use when executing the scan. | no | uptycs/uptycs-ci:latest |
Outputs
no outputs