wetransform/Vulnerability scan

Perform vulnerability scan and report using trivy

Trust Signals

name	description	required	default
image-ref	Image to scan (if not specified an fs scan is done)	no	""
scan-ref	Existing SBOM to use, if set image-ref is ignored	no	""
upload-scan-ref	If the existing SBOM used for scanning should be uploaded as an artifact	no	false
junit-test-output	Location to write JUnit test report to	no	""
create-test-report	If a JUnit test report should be created by the action (otherwise it is assumed to report is handled outside of the action)	no	false
fail-for	Issue types for fail for if they are present (added to JUnit report)	—	""
report-retention-days	Number of days to retain the HTML report	—	30
report-tag	Custom tag for report file, discern multiple reports created in the same run. By the default the job ID is used	—	""
check-image-user	If the user of the Docker image should be checked to be non-root	—	true
create-summary	If a summary should be created	—	true
create-pr-comment	If a sticky PR comment with the vulnerability summary should be created/updated (only on pull_request events; requires pull-requests:write)	—	true
grype-enabled	If the SBOM should additionally be scanned with grype for risk-based reporting	—	true
grype-risk-threshold	Risk threshold on grype's RISK scale (0-100) for the summary count; falls back to a .grype-risk-threshold file, then 40	—	""

no outputs