action-ecr-image-scan

KO | EN

gitlite — search

#react #ai #android #rust #deep-learning #docker #nodejs #java #awesome #kubernetes #awesome-list #mcp #openai #open-source

action-ecr-image-scan

(★ 14)

Github Action to scan docker images

action-ecr-image-scan 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# ECR Image Scanning GitHub Action
This GitHub Action automatically scans an ECR (Elastic Container Registry) image when it is pushed to the repository. It utilizes the AWS CLI and ECR scanning capabilities to perform the scan and provide a scan report.

## Pre-requisites

To use this action, ensure that you have the AWS CLI installed and properly configured in your runner environment.IAM permissions required for this action:

* ecr:DescribeImageScanFindings
 * ecr:StartImageScan

Also ensure that scan on push is disabled on the repository.

## Description

This action utilizes a shell script executed within a Docker container to identify critical and high-level vulnerabilities linked to an image being pushed to the ECR repository.
## Usage
```
name: Push to ECR

on:
  pull_request:
    branches:
      - main
jobs:
  Build-Push-Scan-Image:
    runs-on: ubuntu-latest 
    steps:
    - name: Scan Docker image
      id: docker-scan
      uses: KeyValueSoftwareSystems/action-ecr-image-scan@main
      env:
        ECR_REPOSITORY: ${{ env.ECR_REPOSITORY }}
        IMAGE_TAG:  	${{ github.sha }}
      with:
        ecr_repository: ${{ env.ECR_REPOSITORY }}
        image_tag: ${{ env.IMAGE_TAG }}
        pr_comment: true
        github_token: ${{ secrets.GITHUB_TOKEN }} 
        url: ${{ github.event.pull_request.comments_url }}
        aws_region: ap-south-1    
    - name: Fail workflow if vulnerabilities found
      env:
        vulnerability: ${{ steps.docker-scan.outputs.VULNERABILITY }}  
        block_build_on_failure: true               
      run:  | 
        if [ "${{env.block_build_on_failure }}" = true && "${{ env.vulnerability }}" = true ]; then
        exit 1
        fi
```
## Input

| Input  | Required? | Description |
| ------ | --------- | ----------- |
| ecr_repository | Yes  | The name of your ECR repository |
| image_tag    | Yes | Tag of the image being pushed|
| aws_region | Yes | AWS region of the repository|
| pr_comment | Yes | true/false |
|github_token| No |For updating th PR comment with scan result|
|url| No |URL for calling the POST request to update PR|

## Output

After the scan is completed, this action will produce the scan results and provide a link to the scan report. The scan report and the detailed report URL in the AWS console will be included as comments in the pull request and displayed in the GitHub step summary for easy access and visibility.
### Parameters passed as output :

| Output  | Value | Description |
| ------ | --------- | ----------- |
| VULNERABILITY | true/false | Whether vulnerabilities are found or not |

## Sample Output
#### Github PR comment
![Github PR Comment](https://raw.githubusercontent.com/KeyValueSoftwareSystems/action-ecr-image-scan/main/outputs/github-pr-output.png)

#### Github Summary Report
![Github Summary](https://raw.githubusercontent.com/KeyValueSoftwareSystems/action-ecr-image-scan/main/outputs/github-summary-output.png)

action-ecr-image-scan

action-ecr-image-scan 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

action-ecr-image-scan

action-ecr-image-scan 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README