search

anchore / scan-action

Anchore container analysis and scan provided as a GitHub Action
MIT License
201 stars 75 forks source link

Having the action report only certain level of vulnerabilities and above #321

Open pantelis-karamolegkos opened 3 months ago

pantelis-karamolegkos commented 3 months ago

I know there is the severity-cutoff: <level> option for making the GHA workflow fail if vulnerabilities of a <level> and above are found.

Is there a way however to configure the action to also only report vulnerabilities of a base level and above? The output is kind of overwhelming.

kzantow commented 1 month ago

There is a corresponding change in Grype that is necessary: https://github.com/anchore/grype/issues/1892 (or https://github.com/anchore/grype/issues/197)

popey commented 2 weeks ago

There's an open discussion on discourse over here, if you'd like to help chart this. https://anchorecommunity.discourse.group/t/how-can-we-make-grypes-output-more-focused/57