aquasecurity / trivy-action

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities
Apache License 2.0
806 stars 234 forks source link

build trivy image every run #193

Open navi86 opened 1 year ago

navi86 commented 1 year ago

I see in the example https://github.com/aquasecurity/trivy-action#trivy-action that pipeline only pull Tracy image, however when I use the same action it causes building privy docker image every run

Screenshot 2023-01-24 at 18 39 52
    - name: scan_docker_image_aquasec
      id: scan_docker_image_aquasec
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: ${{ needs.build_container_image.outputs.docker_image }}
        severity: "CRITICAL,HIGH"
        security-checks: vuln
        ignore-unfixed: true
        exit-code: "1"

the logic was updated in this pr https://github.com/aquasecurity/trivy-action/pull/27/files

Screenshot 2023-01-24 at 19 02 25

is it possible to prevent building image every time and point to image in repo ?

chgl commented 3 months ago

Interested in this as well: I'm currently working with the containerd image store backend within hosted GitHub Actions (https://docs.docker.com/storage/containerd/). The "Build aquasecurity/trivy-action" step is ran before I switch to the containerd backend causing the trivy image not to be available in the docker daemon causing the action to fail with

Unable to find image 'e48dca:acac907d7d694e35963247070fe20afb' locally

I'm thinking of switching to manually running the cli but would much prefer having the action just use an existing image vs building one every time.