Skip to content

Container Security Scanning

Container Security Scanning - Reusable Workflow

Orchestrates container discovery, building, and scanning via the argus CLI. Scanner implementation: argus/scanners/container.py, argus/container/

Supports two modes: - discover: Find and build local Dockerfiles, then scan (argus scan container --discover) - remote: Scan pre-existing images from a registry (argus scan container --image)

Exit-code contract

The workflow is green ONLY when every image it was asked to scan was actually scanned. Specifically:

Situation Result
All images scanned, nothing at/above fail_on_severity success
Findings at or above fail_on_severity failure
scan_mode: remote with an empty image_ref failure
An unknown name in scanners failure
An image could not be pulled / a scanner could not run failure
A Dockerfile build failed failure
discover mode found no Dockerfiles success, unless fail_on_no_targets: true

"Nothing could be scanned" is never success. The underlying CLI exits 2 when any requested sub-scanner fails to run (unpullable image, tool unavailable, timeout, unparsable output) and 1 when findings breach the severity threshold; both fail the job. The single deliberate exception is discovery mode finding no Dockerfiles at all, which is a legitimate "this repo has no containers" result — set fail_on_no_targets: true if your repo is expected to always have one.

For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/container-scanning.yml

uses: huntridge-labs/argus/.github/workflows/container-scan.yml@1.12.8

Pipeline

5 jobs (1 matrix) · scroll to zoom · drag to pan

Triggers

  • Manual dispatch
  • Reusable (called by other workflows)

Permissions

Scope Access
contents read
security-events write
actions read
packages read
pull-requests write

Inputs

Input Description Required Default
post_pr_comment Whether to post PR comments boolean No True
enable_code_security Whether GitHub Code Security is enabled for this repository boolean No False
fail_on_severity Fail the job if vulnerabilities at or above this severity are found string No none
scan_mode Scan mode: "discover" or "remote" string No discover
image_ref Remote image reference to scan (required when scan_mode is "remote") string No —
container_name Name identifier for the container (only used when scan_mode is "remote") string No —
search_paths Comma- or newline-separated paths to search for Dockerfiles, mirroring containers.search_paths in argus.yml. Only u... string No .
platform Image platform to scan, e.g. linux/arm64. Scanners read image layers rather than execute them, so a foreign architect... string No —
registry_username Username for authenticating to private container registry string No —
scanners Comma-separated list of sub-scanners to run. Valid names: trivy, grype, syft, exposure, services. An unrecognized nam... string No trivy,grype,syft
fail_on_no_targets Fail when scan_mode is "discover" and no Dockerfiles are found. Default false, because a repository with no container... boolean No False
allow_failure Allow the workflow to continue even if scanning fails boolean No False

Secrets

Secret Description Required
registry_password Password or token for authenticating to private container registry No

Jobs

validate-inputs — Validate Inputs

Runs on: ubuntu-latest

Steps:

  1. Check scan inputs

discover-containers — Discover Container Images

Runs on: ubuntu-latest · Depends on: validate-inputs · Condition: inputs.scan_mode != 'remote'

Steps:

  1. Checkout repository — actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
  2. Set up Python — actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
  3. Install Argus — huntridge-labs/argus/.github/actions/setup-argus@1.12.8
  4. Discover Dockerfiles in repository
  5. Fail if discovery found nothing

build-and-scan — Build & Scan - ${{ matrix.container.name }}

Runs on: ubuntu-latest · Timeout: 30 minutes · Depends on: discover-containers · Continue on error: Yes · Condition: needs.discover-containers.outputs.has_containers == 'true'

Steps:

  1. Checkout repository — actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
  2. Set up Python — actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
  3. Install Argus — huntridge-labs/argus/.github/actions/setup-argus@1.12.8
  4. Set up Docker Buildx — docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069
  5. Build container image
  6. Fail if the image build failed
  7. Run security scanners via argus CLI
  8. Upload container summary section — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
  9. Upload container finding counts — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

scan-remote-image — Scan Remote Image

Runs on: ubuntu-latest · Timeout: 30 minutes · Depends on: validate-inputs · Continue on error: Yes · Condition: inputs.scan_mode == 'remote' && inputs.image_ref != ''

Steps:

  1. Checkout repository — actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
  2. Set up Python — actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
  3. Install Argus — huntridge-labs/argus/.github/actions/setup-argus@1.12.8
  4. Authenticate to container registry
  5. Run security scanners via argus CLI
  6. Upload container summary section — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
  7. Upload container finding counts — actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

container-scan-summary — Container Scan Summary

Runs on: ubuntu-latest · Depends on: validate-inputs, discover-containers, build-and-scan, scan-remote-image · Condition: always()

Steps:

  1. Checkout repository — actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
  2. Download container finding counts — actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
  3. Aggregate counts into workflow outputs
  4. Generate container summary — huntridge-labs/argus/.github/actions/security-summary@1.12.8

Actions used:

All Composite Actions Referenced