StepSecurity Logo
StepSecurity
LoginStart free
aquasecurity/trivy-action

aquasecurity/trivy-action

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities

GitHubGitHub Repository

1385 stars

Composite

Maintained action available

Score updated 10 hours ago

Composite Action Details

Pinnable

Yes

GitHub Actions security score

aquasecurity/trivy-action

Score

7/10

License

Apache License 2.0

Maintained

9 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7

Vulnerabilities

0 existing vulnerabilities detected

Branch protection

branch protection is not maximal on development and all release branches

Manual code review

-

Secure publishing

-

Signed commits

-

Automated security tools

-

Popular

Used by 23976 open-source projects

Security Policy

security policy file not detected

Networking Behavior of aquasecurity/trivy-action

This GitHub Action often makes outbound network calls to these destinations, as gathered from public workflows using the Harden-Runner GitHub Action. Harden-Runner offers network egress filtering and runtime security for both GitHub-hosted and self-hosted runners.

Popular DestinationUnknown Destination
Network DestinationOwner
ghcr.ioGitHubGitHub
pkg-containers.githubusercontent.comGitHubGitHub
quay.ioUnknown
cdn03.quay.ioUnknown
api.github.comGitHubGitHub
cdn02.quay.ioUnknown
api.ecr.eu-west-1.amazonaws.comUnknown
190073735177.dkr.ecr.eu-west-1.amazonaws.comUnknown
prod-eu-west-1-starport-layer-bucket.s3.eu-west-1.amazonaws.comUnknown
index.docker.ioDockerHubDockerHub
auth.docker.ioDockerHubDockerHub
production.cloudflare.docker.comDockerHubDockerHub
sts.googleapis.comGoogleGoogle
iamcredentials.googleapis.comGoogleGoogle
europe-north1-docker.pkg.devUnknown
registry-1.docker.ioDockerHubDockerHub
github.comGitHubGitHub
gcr.ioUnknown
public.ecr.awsUnknown
d2glxqk2uabbnd.cloudfront.netUnknown
d5l0dvt14r5h8.cloudfront.netUnknown
raw.githubusercontent.comGitHubGitHub
objects.githubusercontent.comGitHubGitHub
mcr.microsoft.comMicrosoftMicrosoft
centralus.data.mcr.microsoft.comMicrosoftMicrosoft
westus2.data.mcr.microsoft.comMicrosoftMicrosoft
westus.data.mcr.microsoft.comMicrosoftMicrosoft
eastus.data.mcr.microsoft.comMicrosoftMicrosoft
westcentralus.data.mcr.microsoft.comMicrosoftMicrosoft
mirror.gcr.ioUnknown
cdn01.quay.ioUnknown
dl-cdn.alpinelinux.orgAlpine LinuxAlpine Linux
docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.comDockerHubDockerHub
release-assets.githubusercontent.comGitHubGitHub
check.trivy.devUnknown
www-api.ibm.comUnknown
x.cp.wd.microsoft.comMicrosoftMicrosoft
wdcp.microsoft.comMicrosoftMicrosoft
go.microsoft.comMicrosoftMicrosoft
definitionupdates.microsoft.comMicrosoftMicrosoft
winatp-gw-cus.microsoft.comMicrosoftMicrosoft
global.endpoint.security.microsoft.comMicrosoftMicrosoft
repo.maven.apache.orgUnknown
oss.sonatype.orgUnknown
central.sonatype.comUnknown
us-v20.events.data.microsoft.comMicrosoftMicrosoft
repository.jboss.orgUnknown
registry.terraform.ioUnknown
get.trivy.devUnknown
azcliprod.blob.core.windows.netUnknown
dc.services.visualstudio.comUnknown
management.azure.comAzureAzure
martincostello.azurecr.ioUnknown
uksmanaged246.blob.core.windows.netUnknown
maven.pkg.github.comGitHubGitHub
jitpack.ioUnknown
download.java.netUnknown
packages.microsoft.comMicrosoftMicrosoft
scan.aquasecurtiy.orgUnknown
prod.app-api.stepsecurity.ioUnknown
registry.coder.comUnknown
us-central1-docker.pkg.devUnknown
harbor-hub-shared.arena.3ascloud.deUnknown
production.cloudfront.docker.comUnknown
login.microsoftonline.comMicrosoftMicrosoft
registry.k8s.ioUnknown
us-west2-docker.pkg.devUnknown
prod-registry-k8s-io-us-west-1.s3.dualstack.us-west-1.amazonaws.comUnknown
nvcr.ioUnknown
layers.nvcr.ioUnknown
ghcr1production.blob.core.windows.netUnknown
us-west1-docker.pkg.devUnknown
prod-registry-k8s-io-us-west-2.s3.dualstack.us-west-2.amazonaws.comUnknown
us-east4-docker.pkg.devUnknown
prod-registry-k8s-io-us-east-1.s3.dualstack.us-east-1.amazonaws.comUnknown
prod-registry-k8s-io-us-east-2.s3.dualstack.us-east-2.amazonaws.comUnknown
repo1.maven.orgUnknown
cr-ext.phison.comUnknown
api.ecr.ap-southeast-1.amazonaws.comUnknown
637423223528.dkr.ecr.ap-southeast-1.amazonaws.comUnknown
prod-ap-southeast-1-starport-layer-bucket.s3.ap-southeast-1.amazonaws.comUnknown
api.ecr.us-east-1.amazonaws.comUnknown
247226602506.dkr.ecr.us-east-1.amazonaws.comUnknown
prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.comUnknown
cafe.github.comGitHubGitHub
us-south1-docker.pkg.devUnknown