aquasecurity/trivy-action

aquasecurity/trivy-action

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities

GitHubGitHub Repository

1374 stars

Composite

Maintained action available

Score updated 3 days ago

Composite Action Details

Pinnable

Yes

GitHub Actions security score

aquasecurity/trivy-action

Score

8/10

License

Apache License 2.0

Maintained

18 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10

Vulnerabilities

0 existing vulnerabilities detected

Branch protection

branch protection is not maximal on development and all release branches

Manual code review

-

Secure publishing

-

Signed commits

-

Automated security tools

-

Popular

Used by 7952 open-source projects

Security Policy

security policy file not detected

Networking Behavior of aquasecurity/trivy-action

This GitHub Action often makes outbound network calls to these destinations, as gathered from public workflows using the Harden-Runner GitHub Action. Harden-Runner offers network egress filtering and runtime security for both GitHub-hosted and self-hosted runners.

Popular DestinationUnknown Destination
Network DestinationOwner
ghcr.ioGitHubGitHub
pkg-containers.githubusercontent.comGitHubGitHub
quay.ioUnknown
cdn03.quay.ioUnknown
api.github.comGitHubGitHub
cdn02.quay.ioUnknown
api.ecr.eu-west-1.amazonaws.comUnknown
190073735177.dkr.ecr.eu-west-1.amazonaws.comUnknown
prod-eu-west-1-starport-layer-bucket.s3.eu-west-1.amazonaws.comUnknown
index.docker.ioDockerHubDockerHub
auth.docker.ioDockerHubDockerHub
production.cloudflare.docker.comDockerHubDockerHub
sts.googleapis.comGoogleGoogle
iamcredentials.googleapis.comGoogleGoogle
europe-north1-docker.pkg.devUnknown
registry-1.docker.ioDockerHubDockerHub
github.comGitHubGitHub
gcr.ioUnknown
public.ecr.awsUnknown
d2glxqk2uabbnd.cloudfront.netUnknown
d5l0dvt14r5h8.cloudfront.netUnknown
raw.githubusercontent.comGitHubGitHub
objects.githubusercontent.comGitHubGitHub
mcr.microsoft.comMicrosoftMicrosoft
centralus.data.mcr.microsoft.comMicrosoftMicrosoft
westus2.data.mcr.microsoft.comMicrosoftMicrosoft
westus.data.mcr.microsoft.comMicrosoftMicrosoft
eastus.data.mcr.microsoft.comMicrosoftMicrosoft
westcentralus.data.mcr.microsoft.comMicrosoftMicrosoft
mirror.gcr.ioUnknown
cdn01.quay.ioUnknown
dl-cdn.alpinelinux.orgAlpine LinuxAlpine Linux
docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.comDockerHubDockerHub
release-assets.githubusercontent.comGitHubGitHub
check.trivy.devUnknown
www-api.ibm.comUnknown
x.cp.wd.microsoft.comMicrosoftMicrosoft
wdcp.microsoft.comMicrosoftMicrosoft
go.microsoft.comMicrosoftMicrosoft
definitionupdates.microsoft.comMicrosoftMicrosoft
winatp-gw-cus.microsoft.comMicrosoftMicrosoft
global.endpoint.security.microsoft.comMicrosoftMicrosoft
repo.maven.apache.orgUnknown
oss.sonatype.orgUnknown
central.sonatype.comUnknown
us-v20.events.data.microsoft.comMicrosoftMicrosoft
repository.jboss.orgUnknown
registry.terraform.ioUnknown
get.trivy.devUnknown
azcliprod.blob.core.windows.netUnknown
dc.services.visualstudio.comUnknown
management.azure.comAzureAzure
martincostello.azurecr.ioUnknown
uksmanaged246.blob.core.windows.netUnknown
maven.pkg.github.comGitHubGitHub
jitpack.ioUnknown
download.java.netUnknown
packages.microsoft.comMicrosoftMicrosoft
scan.aquasecurtiy.orgUnknown
prod.app-api.stepsecurity.ioUnknown
registry.coder.comUnknown
us-central1-docker.pkg.devUnknown
harbor-hub-shared.arena.3ascloud.deUnknown
production.cloudfront.docker.comUnknown
login.microsoftonline.comMicrosoftMicrosoft
registry.k8s.ioUnknown
us-west2-docker.pkg.devUnknown
prod-registry-k8s-io-us-west-1.s3.dualstack.us-west-1.amazonaws.comUnknown
nvcr.ioUnknown
layers.nvcr.ioUnknown
ghcr1production.blob.core.windows.netUnknown
us-west1-docker.pkg.devUnknown
prod-registry-k8s-io-us-west-2.s3.dualstack.us-west-2.amazonaws.comUnknown
us-east4-docker.pkg.devUnknown
prod-registry-k8s-io-us-east-1.s3.dualstack.us-east-1.amazonaws.comUnknown
prod-registry-k8s-io-us-east-2.s3.dualstack.us-east-2.amazonaws.comUnknown
repo1.maven.orgUnknown
cr-ext.phison.comUnknown
api.ecr.ap-southeast-1.amazonaws.comUnknown
637423223528.dkr.ecr.ap-southeast-1.amazonaws.comUnknown
prod-ap-southeast-1-starport-layer-bucket.s3.ap-southeast-1.amazonaws.comUnknown
api.ecr.us-east-1.amazonaws.comUnknown
247226602506.dkr.ecr.us-east-1.amazonaws.comUnknown
prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.comUnknown