| registry | Target container registry (docker-hub, ghcr, or both) | no | both |
| dockerhub-username | Docker Hub username (required if registry includes docker-hub) | no | "" |
| dockerhub-token | Docker Hub access token (required if registry includes docker-hub) | no | "" |
| ghcr-token | GitHub token for GHCR (defaults to GITHUB_TOKEN) | no | "" |
| ghcr-username | GitHub username for GHCR (defaults to repository owner) | no | "" |
| main-branch | Name of the main/production branch | no | main |
| dev-branch | Name of the development branch | no | dev |
| dockerfile | Path to Dockerfile | no | ./Dockerfile |
| context | Build context path | no | . |
| platforms | Target platforms (comma-separated, e.g., linux/amd64,linux/arm64) | no | linux/amd64 |
| release-platforms | Target platforms for release builds (overrides platforms for release flows). Set to empty string to use the same platforms as non-release builds. | no | linux/amd64,linux/arm64 |
| build-args | Build arguments (newline-separated, e.g., ARG1=value1) | no | "" |
| labels | Image labels (newline-separated, e.g., key=value) | no | "" |
| cache-enabled | Enable build cache | no | true |
| image-name | Container image name (defaults to repository name) | no | "" |
| tag-prefix | Prefix for image tags (e.g., v1-) | no | "" |
| tag-suffix | Suffix for image tags (e.g., -alpine) | no | "" |
| pr-comment-enabled | Enable PR comments with pull instructions | no | true |
| pr-comment-template | Custom PR comment template (supports variables: {BUILD_FLOW}, {IMAGE_TAGS}, {REGISTRY_URLS}) | no | "" |
| push-enabled | Enable pushing to registry (set to false for testing) | no | true |
| load-enabled | Load image to Docker daemon (useful for local testing) | no | false |
| provenance | Enable provenance attestation | no | true |
| sbom | Enable SBOM attestation | no | true |
| pre-build-scan-enabled | Enable pre-build security scanning (source code + Dockerfile) | no | true |
| scan-source-code | Scan source code and dependencies before building | no | true |
| scan-dockerfile | Scan Dockerfile for misconfigurations and best practices | no | true |
| image-scan-enabled | Enable post-build container image scanning | no | true |
| trivy-severity | Trivy severity levels to scan (comma-separated: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) | no | HIGH,CRITICAL |
| trivy-ignore-unfixed | Ignore vulnerabilities without available fixes | no | false |
| trivy-timeout | Trivy scan timeout duration (e.g., 5m0s, 10m0s) | no | 10m0s |
| trivy-skip-dirs | Directories to skip during Trivy scan (comma-separated) | no | "" |
| trivy-skip-files | Files to skip during Trivy scan (comma-separated) | no | "" |
| upload-sarif | Upload vulnerability scan results to GitHub Security tab (SARIF format) | no | true |
| sarif-category-source | SARIF category name for source code scan | no | trivy-source-scan |
| sarif-category-dockerfile | SARIF category name for Dockerfile scan | no | trivy-dockerfile-scan |
| sarif-category-image | SARIF category name for container image scan | no | trivy-container-scan |
| vulnerability-comment-enabled | Add comprehensive vulnerability scan results to PR comments | no | true |
| enable-image-comparison | Compare vulnerabilities with baseline image | no | false |
| comparison-baseline-image | Baseline image tag to compare against (e.g., myapp:latest) | no | "" |
| fail-on-vulnerability | Fail the build if vulnerabilities are found at or above trivy-severity level | no | false |
| commit-convention-enabled | Enable smart build filtering based on commit message conventions. When enabled, only commits with build-relevant types (e.g., new, fix, update) trigger builds. Commits like docs or test changes are skipped. | no | false |
| commit-convention | Commit message convention to parse. Affects default trigger/skip type lists when not explicitly overridden. clean-commit uses types like new, update, setup; conventional uses feat, fix, perf, etc. | no | clean-commit |
| build-trigger-types | Comma-separated commit types that trigger a container build. If a type appears in both trigger and skip lists, skip takes priority. Leave empty to use convention-aware defaults. | no | "" |
| build-skip-types | Comma-separated commit types that skip the container build. Skip list is checked before trigger list, so skip takes priority if a type appears in both. Leave empty to use convention-aware defaults. | no | "" |
| release-tag-pattern | Regex pattern to match release tags that trigger container builds. Non-matching tags (e.g., monorepo per-package tags like @scope/pkg@1.0.0) are skipped. Use empty string to allow all release tags. | no | ^v?[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$ |
| bot-detection | Auto-detect bot actors (e.g., dependabot[bot], renovate[bot]) and skip the build. Prevents CI failures from missing secrets on bot-generated PRs. | no | true |
| bot-detection-mode | Controls which identity is evaluated for bot detection: smart (default, uses PR author for PR events), actor (always uses github.actor), or pr-author (always uses PR author when available). See README for details. | no | smart |
| floating-tags | Push a mutable floating tag (e.g., dev, pr, patch, staging, wip) for each non-release build in addition to the SHA-pinned tag. Useful for always pulling the latest build of a given flow type without updating the SHA manually. | no | false |