docker-scout.yml

---
name: 🔍 docker-scout

on:
  workflow_call:
    inputs:
      IMAGES:
        description: 'Dockerhub repository name'
        required: true
        type: string
      IMAGE_TAG:
        description: 'Image tag for latest docker image'
        type: string
        default: latest
      COMPARE_TAG:
        description: 'provide the tag of the image you like to compare with'
        required: true
        type: string
      # Filter flags
      IGNORE-BASE:
        description: 'Ignore vulnerabilities from base image'
        default: false
        type: string
      IGNORE-UNCHANGED:
        description: 'Filter out unchanged packages'
        default: true
        type: string
      ONLY-FIXED:
        description: 'Filter to fixable CVEs'
        default: false
        type: string
      WRITE-COMMENT:
        description: 'Write the output as a Pull Request comment'
        default: true
        type: string
    secrets:
      DOCKERHUB_USERNAME:
        description: 'dockerhub username'
        required: true
      DOCKERHUB_PASSWORD:
        description: 'dockerhub password'
        required: true
      TOKEN:
        description: 'Github Token'
        required: true

jobs:
  docker-scout:
    runs-on: ubuntu-latest

    steps:
      - name: 📦 Checkout Repository
        uses: actions/checkout@v7

      - name: ⚙️ Setup Docker buildx
        uses: docker/setup-buildx-action@v4.1.0
        with:
          driver-opts: |
            image=moby/buildkit:v0.10.6

      - name: 🔐 Login to Docker Hub
        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}

      - name: 🛠️ Build docker image
        env:
          IMAGE_TAG: ${{ inputs.IMAGE_TAG }}
          images: ${{ inputs.IMAGES }}
        run: |
          docker build -t $images:$IMAGE_TAG .
          # docker push $images:$IMAGE_TAG

      - name: 🕵️ Docker Scout
        id: docker-scout
        uses: docker/scout-action@v1
        with:
          command: cves,recommendations,compare
          to-latest: false
          to: ${{ inputs.IMAGES }}:${{ inputs.COMPARE_TAG }}
          image: ${{ inputs.IMAGES }}:${{ inputs.IMAGE_TAG }}
          ignore-base: ${{ inputs.IGNORE-BASE }}
          ignore-unchanged: ${{ inputs.IGNORE-BASE }}
          only-fixed: ${{ inputs.ONLY-FIXED }}
          write-comment: ${{ inputs.WRITE-COMMENT }}
          github-token: ${{ secrets.TOKEN }}
...