Skip to content

Release v2.0.0

Marketplace
Marketplace
Compare
Choose a tag to compare
@zhill zhill released this 30 Sep 06:48
· 215 commits to main since this release
v2.0.0
c2212d9
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

New major version of scan action based on new Grype tool from Anchore that is much faster for scanning compared to v1.x and adds some new capabilities and more metadata about the matches.

  • Significantly faster performance for scans
  • New vulnerabilities output format is the JSON output from Grype directly
  • Adds support for scanning directories as well as Docker containers, so you can do the same checks pre-and post-build of the container.
  • Supports Automatic Code Scanning/SARIF for exposing results via your repository's Security tab.

This is a breaking change from v1.x, as indicated by the major version revision:

  1. Use image input parameter Instead of image-reference
  2. dockerfile-path is no longer supported and not necessary for the vulnerability scans
  3. custom-policy-path is no longer supported
  4. include-app-packages is no longer necessary or supported. Application packages are on by default and will receive vulnerability matches.
  5. Outputs:
    1. billofmaterials is no longer output. V2 is focused on vulnerability scanning and another action may be introduced for BoM support with its own options/config.
    2. policycheck is no longer output
Assets 2
Loading