Sysdig Secure Inline Scan Action

This action performs analysis on locally built container image and posts the result to Sysdig Secure. For more information about Secure Inline Scan, see Sysdig Secure documentation.

Inputs

`image-tag`

Required The tag of the local image to scan. Example: "sysdiglabs/dummy-vuln-app:latest".

`sysdig-secure-token`

Required API token for Sysdig Scanning auth. Example: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx".

Directly specifying the API token in the action configuration is not recommended. A better approach is to store it in GitHub secrets, and reference ${{ secrets.MY_SECRET_NAME }} instead.

`sysdig-secure-url`

Sysdig Secure URL. Example: https://secure-sysdig.svc.cluster.local

If not specified, it will default to Sysdig Secure SaaS URL (https://secure.sysdig.com).

For SaaS, eee SaaS Regions and IP Ranges.

`sysdig-skip-tls`

Skip TLS verification when calling secure endpoints.

`dockerfile-path`

Path to Dockerfile. Example: "./Dockerfile".

`ignore-failed-scan`

Don't fail the execution of this action even if the scan result is FAILED.

`input-type`

If specified, where should we scan the image from. Possible values:

pull: Pull the image from the registry. Default if not specified.
docker-daemon: Get the image from the Docker daemon. The Docker socket must be available at /var/run/docker.sock
cri-o: Get the image from containers-storage (CRI-O and others). Images must be stored in /var/lib/containers
docker-archive: Image is provided as a Docker .tar file (from Docker save). Specify the path to the tar file with input-path parameter.
oci-archive: Image is provided as a OCI image tar file. Specify the path to the tar file with input-path parameter.
oci-dir: Image is provided as a OCI image, untared. Specify the path to the directory file with input-path parameter.

`input-path`

Path to the tar file or OCI layout directory, or the Docker daemon when using input-type: docker-daemon, in case the docker.sock file is not in the default path /var/run/docker.sock.

`run-as-user`

Run the scan container with this username or UID. It might be required when scanning from docker-daemon or cri-o to provide a user with permissions on the socket or storage.

`extra-parameters`

Additional parameters added to the secure-inline-scan container execution.

`extra-docker-parameters`

Additional parameters added to the docker command when executing the secure-inline-scan container execution.

`severity`

Filter output annotations by severity. Default is "unknown". Possible values:

critical
high
medium
negligible
unknown

`unique-report-by-package`

Only one annotation by package name/version will be displayed in the build output. The last highest (by severity) vulnerability will be displayed by package. It increases the readability of the output, avoiding duplicates for the same package. Default to false.

`inline-scan-image`

The image quay.io/sysdig/secure-inline-scan:2, which points to the latest 2.x version of the Sysdig Secure inline scanner is used by default. This parameter allows overriding the default image, to use a specific version or for air-gapped environments.

SARIF Report

The action generates a SARIF report that can be uploaded using the codeql-action/upload-sarif action.

You need to assign an ID to the Sysdig Scan Action step, like:

    ...

    - name: Scan image
      id: scan
      uses: sysdiglabs/scan-action@v3
      with:
        ...

and then add another step for uploading the SARIF report, providing the path in the sarifReport output:

    ...
      - uses: github/codeql-action/upload-sarif@v1
        with:
          if: always()
          sarif_file: ${{ steps.scan.outputs.sarifReport }}

The if: always() option makes sure the SARIF report is uploaded even if the scan fails and interrupts the workflow.

Example usages

Build and scan image locally using Docker, and upload SARIF report

    ...

    - name: Build the Docker image
      run: docker build . --file Dockerfile --tag sysdiglabs/dummy-vuln-app:latest

    - name: Scan image
      id: scan
      uses: sysdiglabs/scan-action@v3
      with:
        image-tag: "sysdiglabs/dummy-vuln-app:latest"
        sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}
        input-type: docker-daemon
        run-as-user: root

      - uses: github/codeql-action/upload-sarif@v1
        if: always()
        with:
          sarif_file: ${{ steps.scan.outputs.sarifReport }}

Pull and scan an image from a registry

    ...

    - name: Scan image
      uses: sysdiglabs/scan-action@v3
      with:
        image-tag: "sysdiglabs/dummy-vuln-app:latest"
        sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}

Scan a Docker archive image

    ...

    - name: Scan image
      uses: sysdiglabs/scan-action@v3
      with:
        image-tag: "sysdiglabs/dummy-vuln-app:latest"
        sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}
        input-type: docker-archive
        input-path: artifacts/my-image.tar

mavimo / scan-action