build-failure / amazon-inspector-vulnerability-scan

Contains reusable GitHub Actions workflow to generate container image SBOM using Amazon Inspector SBOM Generator and scan it using Amazon Inspector Scan API.

Amazon Inspector Vulnerability Scan Workflow

Contains reusable GitHub Actions workflow to generate container image SBOM using Amazon Inspector SBOM Generator and scan it using Amazon Inspector Scan API.

Resulting vulnerability report is validated against specified threshold.

Inputs

docker-image-name

Docker image name. Default "test/dev".

docker-context

Relative path to docker file. Default ".".

docker-file

Dockerfile name. Default "Dockerfile".

amazon-inspector-scan-assume-role

Assume role to execute scan using Amazon Inspector scan API.

amazon-inspector-scan-region

Region to execute scan using Amazon Inspector scan API. Default "us-east-1".

amazon-inspector-scan-endpoint

Endpoint to execute scan using Amazon Inspector scan API. Default "https://inspector-scan.us-east-1.amazonaws.com".

threshold

Vulnerability threshold. Default "critical".

Example usage

on:
  push:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  scan-image:
    uses: build-failure/amazon-inspector-vulnerability-scan/.github/workflows/amazon-inspector-image-scan.yml@v1
    with:
      docker-image-name: test/dev
      docker-context: .
      amazon-inspector-scan-assume-role: arn:aws:iam::<ACCOUNT_ID>:role/<ASSUME_ROLE_NAME>
      amazon-inspector-scan-region: us-east-1
      amazon-inspector-scan-endpoint: https://inspector-scan.us-east-1.amazonaws.com
      threshold: critical