scout.yml

name: scout
on:
  workflow_dispatch:
    inputs:
      severities:
        description: "Comma-separated list of severities to scan for: critical, high, medium, low, unspecified"
        required: true
        type: string
        default: critical,high
  schedule:
    - cron: "0 0 * * 3"
jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to Docker Hub
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
          logout: true
      - name: Image CVEs
        uses: docker/scout-action@2688993af7bafd6ba8c6a74ec652442be91dd82b # v1.23.1
        with:
          command: cves
          image: ${{ vars.IMAGE }}
          only-severities: ${{ inputs && inputs.severities || 'critical,high' }}
          only-fixed: true
          summary: true
          format: json
          exit-code: true
      - name: Image recommendations
        continue-on-error: true
        uses: docker/scout-action@2688993af7bafd6ba8c6a74ec652442be91dd82b # v1.23.1
        with:
          command: recommendations
          image: ${{ vars.IMAGE }}
          only-severities: ${{ inputs && inputs.severities || 'critical,high' }}
          only-fixed: true
          summary: true
          format: json