Container Security Scanning

Container Security Scanning - Reusable Workflow

THIN WRAPPER: This workflow orchestrates container discovery, building, and scanning. Scanning is delegated to: .github/actions/scanner-container/action.yml

Supports two modes: - discover: Find and build local Dockerfiles, then scan - remote: Scan pre-existing images from a registry

For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/container-scanning.yml

uses: huntridge-labs/argus/.github/workflows/container-scan.yml@0.6.7

Pipeline

4 jobs (1 matrix) · scroll to zoom · drag to pan

Triggers

• Manual dispatch
• Reusable (called by other workflows)

Permissions

Scope	Access
contents	read
security-events	write
actions	read
packages	read
pull-requests	write

Inputs

Input	Description	Required	Default
post_pr_comment	Whether to post PR comments boolean	No	True
enable_code_security	Whether GitHub Code Security is enabled for this repository boolean	No	False
fail_on_severity	Fail the job if vulnerabilities at or above this severity are found string	No	none
scan_mode	Scan mode: "discover" or "remote" string	No	discover
image_ref	Remote image reference to scan (only used when scan_mode is "remote") string	No	—
container_name	Name identifier for the container (only used when scan_mode is "remote") string	No	—
registry_username	Username for authenticating to private container registry string	No	—
scanners	Comma-separated list of scanners to run: trivy,grype,syft string	No	trivy,grype,syft
allow_failure	Allow the workflow to continue even if scanning fails boolean	No	False

Secrets

Secret	Description	Required
registry_password	Password or token for authenticating to private container registry	No

Jobs

discover-containers — Discover Container Images

Runs on: ubuntu-latest · Condition: inputs.scan_mode != 'remote'

Steps:

1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2. Discover Dockerfiles in repository

build-and-scan — Build & Scan - ${{ matrix.container.name }}

Runs on: ubuntu-latest · Timeout: 30 minutes · Depends on: discover-containers · Continue on error: Yes · Condition: needs.discover-containers.outputs.has_containers == 'true'

Steps:

1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2. Set up Docker Buildx — docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
3. Build container image
4. Run security scanners — huntridge-labs/argus/.github/actions/scanner-container@0.6.7

Actions used:

• 📦 scanner-container — Container Security Scanner

scan-remote-image — Scan Remote Image

Runs on: ubuntu-latest · Timeout: 30 minutes · Continue on error: Yes · Condition: inputs.scan_mode == 'remote' && inputs.image_ref != ''

Steps:

1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2. Authenticate to container registry
3. Run security scanners — huntridge-labs/argus/.github/actions/scanner-container@0.6.7

Actions used:

• 📦 scanner-container — Container Security Scanner

container-scan-summary — Container Scan Summary

Runs on: ubuntu-latest · Depends on: discover-containers, build-and-scan, scan-remote-image · Condition: always()

Steps:

1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2. Download all scan artifacts — actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
3. Generate container summary — huntridge-labs/argus/.github/actions/scanner-container-summary@0.6.7

Actions used:

• 📦 scanner-container-summary — Container Scanner Summary

All Composite Actions Referenced

• 📦 scanner-container — Container Security Scanner
• 📦 scanner-container-summary — Container Scanner Summary