search

aquasecurity / trivy-action

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities
Apache License 2.0
807 stars 234 forks source link

Description for image-ref has "for backward compatibility" comment #94

Open jawnsy opened 2 years ago

jawnsy commented 2 years ago

The image-ref description has the following:

https://github.com/aquasecurity/trivy-action/blob/9c21d3ca2c14eb35419e2a8b66d1195946d579b8/action.yaml#L10

To me, this implies that use of image-ref is discouraged and preserved only for compatibility. Is that correct? If so, what should users prefer instead?

I tried using scan-ref, but this results in images not being scanned at all, and no error message being emitted either (the checks pass and the logs only show Trivy's help output).

simar7 commented 2 years ago

Yes that's correct. If you're looking to scan an image the following is an example:

$ trivy image alpine:3.10

In this case, scan-type is image, scan-ref is alpine:3.10