upwindsecurity/Upwind Security Image Scanning
Scan against built images
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| upwind_client_id | Upwind Client ID | yes | — |
| upwind_client_secret | Upwind Client Secret | yes | — |
| docker_image | Already built docker image residing on same runner | yes | — |
| docker_user | User to authenticate to the Docker registry | no | — |
| docker_password | Password to authenticate to the Docker registry | no | — |
| pull_image | Attempt to pull the image. Set to false if image is available locally | — | true |
| oci_client | Client with which to pull image. Options are docker (default), podman, and skopeo | — | docker |
| additional_registries | Comma-separated list of additional registries to associate with the scanned image, passed as a string | no | — |
| output_json | File location to write JSON output to | — | output.json |
| commit_sha | SHA to be associated with the build. By default this uses the $GITHUB_SHA environmental variable | no | ${GITHUB_SHA} |
| upwind_uri | Public Upwind URI domain name | no | upwind.io |
| use_sudo | whether to use sudo when invoking the scan to connect to the OCI client | no | true |
| github_token | GitHub token for authentication | no | — |
| pr_number | Pull request number | no | — |
| repo_name | The GitHub repository in owner/repo format | no | — |
| add_comment | Whether to add a comment to the PR when a scan is completed | no | false |
| perform_multiarchitecture_image_scan | Whether to perform a multi-arch image scan or not, defaulted to true | no | true |
| debug | Enable debug logging | — | false |
| main_branch | Base/target branch to diff against (e.g. the PR's base branch, typically github.event.pull_request.base.ref). When set, introduced/resolved CVEs are computed vs the latest scanned image of this branch instead of the previously scanned image. Requires that branch to have been scanned. | no | — |
| pr_id | Pull request identifier associated with the scan (optional) | no | — |
| pr_link | Pull request URL associated with the scan (optional) | no | — |
| block_on | Block workflow based on Upwind Scan Recommendation. Can be either 'do_not_deploy' or 'deploy_with_caution' | — | — |
Outputs
no outputs