Skip to content

Grype Container Scanner

Grype Container Scanner - Reusable Workflow

Runs the Grype container scanner via the argus Python CLI. Equivalent to: python -m argus scan container --image --scanners grype

For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/container-scanning.yml

uses: huntridge-labs/argus/.github/workflows/scanner-grype.yml@1.12.2

Triggers

  • Manual dispatch
  • Reusable (called by other workflows)

Permissions

Scope Access
contents read
security-events write
actions read
pull-requests write
packages read

Inputs

Input Description Required Default
allow_failure When true (default) the scan never fails the job (non-blocking); when false, a scan crash or a fail_on_severity breac... boolean No True
image_ref Container image reference to scan (e.g., nginx:latest, ghcr.io/owner/image:tag) string Yes —
scan_name Name for the scan artifacts string No container
registry_username Username for registry authentication (leave empty for public images) string No —
enable_code_security Whether to upload SARIF to GitHub Security boolean No False
post_pr_comment Whether to post PR comments boolean No False
fail_on_severity Fail the job if vulnerabilities at or above this severity are found. Options: none, low, medium, high, critical. Set ... string No none

Secrets

Secret Description Required
registry_password Password/token for registry authentication No

Jobs

grype-container-scan — Grype Container Scan

Runs on: ubuntu-latest · Timeout: 20 minutes · Continue on error: Yes

Steps:

  1. Checkout repository — actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
  2. Set up Python — actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
  3. Install Argus — huntridge-labs/argus/.github/actions/setup-argus@1.12.2
  4. Run scan
  5. Upload artifacts — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
  6. Build scanner summary
  7. Upload scanner summary — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
  8. Upload SARIF — github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
  9. Comment PR with results — huntridge-labs/argus/.github/actions/comment-pr@1.12.2