This is a GitHub Action for invoking the Anchore Engine scanner on a docker image and returning the vulnerabilities found, manifest of contents found, and a pass/fail policy evaluation that can be used to fail the build if desired.

Use this in your workflows to verify the content of Docker containers after build and before pushing, allowing PRs, or deploying updates.

The action invokes the inline version of anchore engine, which is a script and docker image that run completely locally and scan a local docker image and return the content, policy evaluation, and a final pass/fail status for the image.

No data is sent to a remote service to execute the scan, and no credentials are required

The vulnerability source data (from RedHat, Debian, Alpine, etc) is pre-baked into the container that is executed, so no external fetch or initialization is necessary beyond pulling the container to execute.

By default, the action uses anchore engine to analyze the container and provide a listing of the packages found inside, the vulnerabilities matched to those packages, and a policy evaluation recommendation. The job step will not fail the workflow even if vulnerabilities are found.

In your workflow file, add a step:

 - name: Scan image
   uses: anchore/scan-action@master
   with:
     image-reference: "localbuild/testimage:latest"

The above example will run the action but not cause the build to fail based on results. If you want to have the build step fail in cases where there are vulnerabilities that violate the default policy (fail only if vulnerabilities exist with severity >= HIGH and which have a fix available), then set the fail-build input = true. That will make the job step fail of the policy evaluations detects a policy violation.

For example:

 - name: Scan image
   uses: anchore/scan-action@master
   with:
     image-reference: "localbuild/testimage:latest"
     fail-build: true

As a result of the action, you'll see some files in the anchore-reports directory in the workspace:

• policy_evaluation.json - Default anchore policy evaluation of the image
• vulnerabilities.json - Vulnerabilities found in the image
• content.json - packages (rpms, debs, npms, jars, gems, etc) found in the image, including versions, locations, and licenses

By default, the action will only match vulnerabilities against OS/distro packages (rpms, dpkg, apk, etc). This is done to allow the use of a much smaller scan image and thus faster scans. However, Anchore has the ability to match vulnerabilities against npms, gems, python pip packages, and java (jars, wars, etc) as well. This scan will take longer, but produce a more holistic view of the container vulnerability set. To enable this feature, set the 'include-app-packages' input parameter to 'true'.

For example:

 - uses: anchore/scan-action@master
       with:
         image-reference: "localbuild/testimage:latest"
         dockerfile-path: "./Dockerfile"
         fail-build: true
         include-app-packages: true

The default policy the action applies can fail the build if vulnerability with severity >= High is found that has a fix available. To have other behavior, you can provide your own policy using the custom-policy-path parameter. The path is considered relative to the root of the workspace (which gets reset to the repository if you use the checkout action).

For example, to include a custom policy as: .anchore/policy.json in your code repository, set:

 - uses: anchore/scan-action@master
       with:
         image-reference: "localbuild/testimage:latest"
         dockerfile-path: "./Dockerfile"
         fail-build: true
         custom-policy-path: .anchore/policy.json

For an overview of policy format and the checks it can perform, see the Anchore policy bundle documentation

Assuming your repository has a Dockerfile in the root directory:

name: Docker Image CI
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
    - name: Build the Docker image
      run: docker build . --file Dockerfile --tag localbuild/testimage:latest
    - uses: anchore/scan-action@master
      with:
        image-reference: "localbuild/testimage:latest"
        dockerfile-path: "./Dockerfile"
        fail-build: true
    - name: anchore inline scan JSON results
      run: for j in `ls ./anchore-reports/*.json`; do echo "---- ${j} ----"; cat ${j}; echo; done

We love contributions, feedback, and bug reports. For issues with the invocation of this action, file issues in this repository.

For contributing, see Contributing.

For documentation on Anchore itself, including policy language and capabilities see the Anchore Documentation

Connect with the anchore community directly on slack.