Skip to content

Add scan-image action to check for vulnerabilities #1372

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

Add scan-image action to check for vulnerabilities #1372

wants to merge 1 commit into from

Conversation

Lantero
Copy link

@Lantero Lantero commented Oct 3, 2025

No description provided.

@Lantero Lantero force-pushed the scan-image-action branch 4 times, most recently from 46c03b6 to 0e83ad3 Compare October 7, 2025 08:10
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 7, 2025
View reviewed changes
@Lantero Lantero force-pushed the scan-image-action branch from 0e83ad3 to 95bbb52 Compare October 7, 2025 08:32
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 7, 2025
View reviewed changes
@Lantero Lantero force-pushed the scan-image-action branch from 95bbb52 to 1245d3a Compare October 7, 2025 08:38
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 7, 2025
View reviewed changes
actions/scan-image/action.yaml
id: extract-registry
shell: bash
run: |
IMAGE_NAME="${{ inputs.image_name }}"

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
@Lantero Lantero force-pushed the scan-image-action branch from 1245d3a to efe6f8a Compare October 7, 2025 08:51
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 7, 2025
View reviewed changes
actions/scan-image/action.yaml
- name: Setup Trivy (Latest)
id: setup-trivy-latest
if: inputs.trivy_version == ''
uses: aquasecurity/[email protected]

Check failure

Code scanning / zizmor

unpinned action reference Error

unpinned action reference
actions/scan-image/action.yaml
- name: Setup Trivy (Pinned)
id: setup-trivy-pinned
if: inputs.trivy_version != ''
uses: aquasecurity/[email protected]

Check failure

Code scanning / zizmor

unpinned action reference Error

unpinned action reference
@Lantero Lantero force-pushed the scan-image-action branch 3 times, most recently from a30172f to 501778d Compare October 7, 2025 08:57
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 7, 2025
View reviewed changes
@Lantero Lantero force-pushed the scan-image-action branch 2 times, most recently from bea85e8 to 86bc0dd Compare October 11, 2025 09:04
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 11, 2025
View reviewed changes
@Lantero Lantero force-pushed the scan-image-action branch 4 times, most recently from aaaa710 to b8f04e3 Compare October 11, 2025 12:32
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 11, 2025
View reviewed changes
actions/scan-image/action.yaml
id: run-trivy
shell: bash
run: |
trivy image ${{ inputs.image_name }} -f json -o trivy.json

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 11, 2025
View reviewed changes
actions/scan-image/action.yaml
- name: Setup Grype (Latest)
id: setup-grype-latest
if: inputs.grype_version == ''
uses: anchore/scan-action/download-grype@v7

Check failure

Code scanning / zizmor

unpinned action reference Error

unpinned action reference
actions/scan-image/action.yaml
- name: Setup Grype (Pinned)
id: setup-grype-pinned
if: inputs.grype_version != ''
uses: anchore/scan-action/download-grype@v7

Check failure

Code scanning / zizmor

unpinned action reference Error

unpinned action reference
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 11, 2025
View reviewed changes
actions/scan-image/action.yaml
id: run-grype
shell: bash
run: |
${{ inputs.grype_version == '' && steps.setup-grype-latest.outputs.cmd || steps.setup-grype-pinned.outputs.cmd }} ${{ inputs.image_name }} -o cyclonedx-json > grype-cdx.json

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
@Lantero Lantero force-pushed the scan-image-action branch 3 times, most recently from d6d1b80 to 1c42928 Compare October 11, 2025 14:20
@Lantero Lantero force-pushed the scan-image-action branch 2 times, most recently from 5bfb373 to 440e6e8 Compare October 11, 2025 14:26
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 11, 2025
View reviewed changes
@Lantero Lantero force-pushed the scan-image-action branch 2 times, most recently from 88aa333 to 9a54ebc Compare October 11, 2025 14:32
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 11, 2025
View reviewed changes
actions/scan-image/action.yaml
# Check if result.json is empty or has no entries
if [[ $(jq '. | length' result.json) -eq 0 ]]; then
# No CVEs found
echo "# CVE Report (${{ inputs.image_name }}) :white_check_mark:

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 11, 2025
View reviewed changes
.github/workflows/test-scan-image.yaml
Comment on lines +32 to +37
- name: (Test 1) Scan public image without vulnerabilities
id: scan-image-1
uses: Lantero/shared-workflows/actions/scan-image@1c42928e7de3547403e934df7fa59a3e59865a75 # scan-action/v0.1.0
with:
image_name: docker.io/hello-world
image_source: public

Check failure

Code scanning / zizmor

commit with no history in referenced repository Error test

commit with no history in referenced repository
.github/workflows/test-scan-image.yaml
Comment on lines +39 to +46
- name: (Test 2) Scan public image with some vulnerabilities (Pinned Trivy and Grype)
id: scan-image-2
uses: Lantero/shared-workflows/actions/scan-image@1c42928e7de3547403e934df7fa59a3e59865a75 # scan-action/v0.1.0
with:
image_name: docker.io/redis:7.4.0-alpine
image_source: public
trivy_version: v0.66.0
grype_version: v0.98.0

Check failure

Code scanning / zizmor

commit with no history in referenced repository Error test

commit with no history in referenced repository
.github/workflows/test-scan-image.yaml
Comment on lines +48 to +53
- name: (Test 3) Scan private DockerHub image for vulnerabilities
id: scan-image-3
uses: Lantero/shared-workflows/actions/scan-image@1c42928e7de3547403e934df7fa59a3e59865a75 # scan-action/v0.1.0
with:
image_name: ${{ github.repository }}@${{ steps.build.outputs.digest }}
image_source: private_dockerhub

Check failure

Code scanning / zizmor

commit with no history in referenced repository Error test

commit with no history in referenced repository
.github/workflows/test-scan-image.yaml
Comment on lines +55 to +60
- name: (Test 4) Scan private GAR image for vulnerabilities
id: scan-image-4
uses: Lantero/shared-workflows/actions/scan-image@1c42928e7de3547403e934df7fa59a3e59865a75 # scan-action/v0.1.0
with:
image_name: us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/terraform-team:1.7.5-16-0-amd64
image_source: private_gar No newline at end of file

Check failure

Code scanning / zizmor

commit with no history in referenced repository Error test

commit with no history in referenced repository
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 11, 2025
View reviewed changes
actions/scan-image/action.yaml
else
## CVEs found, create table
MARKDOWN_CONTENT="
## CVE Report (${{ inputs.image_name }}) :warning:

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
@Lantero Lantero force-pushed the scan-image-action branch 3 times, most recently from 364892c to deffcdb Compare October 11, 2025 15:07
github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 13, 2025
View reviewed changes
actions/scan-image/action.yaml
id: fail-condition
shell: bash
run: |
if [[ ${{ inputs.fail_on_threshold }} -lt 1 ]]; then

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
actions/scan-image/action.yaml
["critical"]=4
)

echo "Checking for vulnerabilities with severity >= ${{ inputs.fail_on }} (level ${{ inputs.fail_on_threshold }})"

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
actions/scan-image/action.yaml
["critical"]=4
)

echo "Checking for vulnerabilities with severity >= ${{ inputs.fail_on }} (level ${{ inputs.fail_on_threshold }})"

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
actions/scan-image/action.yaml
["critical"]=4
)

echo "Checking for vulnerabilities with severity >= ${{ inputs.fail_on }} (level ${{ inputs.fail_on_threshold }})"

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
actions/scan-image/action.yaml

current_level=${severity_levels[$severity_lower]}

if [[ $current_level -ge $${{ inputs.fail_on }} ]]; then

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
actions/scan-image/action.yaml
fi
done < <(jq -r '. | to_entries[] | "\(.key)\t\(.value.severity)\t\(.value.url)"' result.json)

echo "Found $vulnerability_count vulnerabilities at or above ${{ inputs.fail_on }} severity level"

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
actions/scan-image/action.yaml
echo "Found $vulnerability_count vulnerabilities at or above ${{ inputs.fail_on }} severity level"

# Fail if vulnerability count meets or exceeds threshold
if [[ $vulnerability_count -ge ${{ inputs.fail_on_threshold }} ]]; then

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
actions/scan-image/action.yaml
echo "Found $vulnerability_count vulnerabilities at or above ${{ inputs.fail_on }} severity level"

# Fail if vulnerability count meets or exceeds threshold
if [[ $vulnerability_count -ge ${{ inputs.fail_on_threshold }} ]]; then

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
actions/scan-image/action.yaml
echo "Found $vulnerability_count vulnerabilities at or above ${{ inputs.fail_on }} severity level"

# Fail if vulnerability count meets or exceeds threshold
if [[ $vulnerability_count -ge ${{ inputs.fail_on_threshold }} ]]; then

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
actions/scan-image/action.yaml

# Fail if vulnerability count meets or exceeds threshold
if [[ $vulnerability_count -ge ${{ inputs.fail_on_threshold }} ]]; then
echo "❌ FAIL: Found $vulnerability_count vulnerabilities (threshold: ${{ inputs.fail_on_threshold }})"

Check failure

Code scanning / zizmor

code injection via template expansion Error

code injection via template expansion
@Lantero Lantero closed this Oct 20, 2025
@Lantero Lantero deleted the scan-image-action branch October 20, 2025 15:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Lantero