vikrambathala4/Vulnerability Scan GitHub Action for Amazon Inspector

Generate SBOMs and scan for vulnerabilities in artifacts such as files, directories, containers, and more.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
artifact_type	The artifact you would like to scan with Amazon Inspector. Valid choices are "repository", "container", "binary", or "archive".	yes	repository
artifact_path	The file path to the artifact you would like to scan with Amazon Inspector. File paths are relative to the root project directory. If scanning a container image, you must provide a value that follows the docker pull convention: "NAME[:TAG\|@DIGEST]", for example, "alpine:latest", or a path to an image exported as tarball using "docker save".	yes	./
display_vulnerability_findings	If set to "enabled", the action will display detailed vulnerability findings in the step summary page; see here for an example report: https://github.com/aws-actions/vulnerability-scan-github-action-for-amazon-inspector/actions/runs/8878213714	yes	disabled
output_sbom_path	The destination file path for the generated SBOM.	no	./sbom_${{ github.run_id }}.json
output_inspector_scan_path	The destination file path for Inspector's vulnerability scan (JSON format).	no	inspector_scan_${{ github.run_id }}.json
output_inspector_scan_path_csv	The destination file path for Inspector's vulnerability scan (CSV format).	no	inspector_scan_${{ github.run_id }}.csv
output_inspector_scan_path_markdown	The destination file path for Inspector's vulnerability scan (markdown format).	no	inspector_scan_${{ github.run_id }}.md
output_inspector_dockerfile_scan_path_csv	The destination file path for Inspector's Dockerfile vulnerability scan (CSV format).	no	inspector_dockerfile_scan_${{ github.run_id }}.csv
output_inspector_dockerfile_scan_path_markdown	The destination file path for Inspector's Dockerfile vulnerability scan (markdown format).	no	inspector_dockerfile_scan_${{ github.run_id }}.md
sbomgen_version	The inspector-sbomgen version you wish to use for SBOM generation. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	no	latest
critical_threshold	Specifies the number of critical vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	no	0
high_threshold	Specifies the number of high vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	no	0
medium_threshold	Specifies the number of medium vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	no	0
low_threshold	Specifies the number of low vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	no	0
other_threshold	Specifies the number of other vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	no	0
scanners	Specifies the file scanners that you would like inspector-sbomgen to execute. By default, inspector-sbomgen will try to run all file scanners that are applicable to the target artifact. If this argument is set, inspector-sbomgen will only execute the specified file scanners. Provide your input as a single string. Separate each file scanner with a comma. To view a list of available file scanners, execute 'inspector-sbomgen list-scanners'. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	no	''
skip_scanners	Specifies a list of file scanners that should NOT be executed; this argument cannot be combined with 'scanners'. If this argument is set, inspector-sbomgen will execute all file scanners except those you specified. Provide your input as a single string. Separate each file scanner with a comma. To view a list of available file scanners, execute 'inspector-sbomgen list-scanners'. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	no	''
skip_files	Specifies one or more files and/or directories that should NOT be inventoried. Separate each file with a comma and enclose the entire string in double quotes.	no	''
timeout	Specifies a timeout in seconds. If this timeout is exceeded, the action will gracefully conclude and present any findings discovered up to that point.	no	600

Outputs

name	description
artifact_sbom	The filepath to the artifact's software bill of materials.
inspector_scan_results	The file path to the Inspector vulnerability scan findings in JSON format.
inspector_scan_results_csv	The file path to the Inspector vulnerability scan findings in CSV format.
inspector_scan_results_markdown	The file path to the Inspector vulnerability scan findings in markdown format.
inspector_dockerile_scan_results_csv	The file path to the Inspector Dockerfile vulnerability scan findings in CSV format.
inspector_dockerile_scan_results_markdown	The file path to the Inspector Dockerfile vulnerability scan findings in markdown format.
vulnerability_threshold_exceeded	This variable is set to 1 if any vulnerability threshold was exceeded, otherwise it is 0. This variable can be used to trigger custom logic, such as failing the job if vulnerabilities were detected.