GitHub Action
Scan Container Images On Push to ECR
This GitHub Action automatically scans an ECR (Elastic Container Registry) image when it is pushed to the repository. It utilizes the AWS CLI and ECR scanning capabilities to perform the scan and provide a scan report.
To use this action, ensure that you have the AWS CLI installed and properly configured in your runner environment.IAM permissions required for this action:
- ecr:DescribeImageScanFindings
- ecr:StartImageScan
Also ensure that scan on push is disabled on the repository.
This action utilizes a shell script executed within a Docker container to identify critical and high-level vulnerabilities linked to an image being pushed to the ECR repository.
name: Push to ECR
on:
pull_request:
branches:
- main
jobs:
Build-Push-Scan-Image:
runs-on: ubuntu-latest
steps:
- name: Scan Docker image
id: docker-scan
uses: KeyValueSoftwareSystems/action-ecr-image-scan@main
env:
ECR_REPOSITORY: ${{ env.ECR_REPOSITORY }}
IMAGE_TAG: ${{ github.sha }}
with:
ecr_repository: ${{ env.ECR_REPOSITORY }}
image_tag: ${{ env.IMAGE_TAG }}
pr_comment: true
github_token: ${{ secrets.GITHUB_TOKEN }}
url: ${{ github.event.pull_request.comments_url }}
aws_region: ap-south-1
- name: Fail workflow if vulnerabilities found
env:
vulnerability: ${{ steps.docker-scan.outputs.VULNERABILITY }}
block_build_on_failure: true
run: |
if [ "${{env.block_build_on_failure }}" = true && "${{ env.vulnerability }}" = true ]; then
exit 1
fi
Input | Required? | Description |
---|---|---|
ecr_repository | Yes | The name of your ECR repository |
image_tag | Yes | Tag of the image being pushed |
aws_region | Yes | AWS region of the repository |
pr_comment | Yes | true/false |
github_token | No | For updating th PR comment with scan result |
url | No | URL for calling the POST request to update PR |
After the scan is completed, this action will produce the scan results and provide a link to the scan report. The scan report and the detailed report URL in the AWS console will be included as comments in the pull request and displayed in the GitHub step summary for easy access and visibility.
Output | Value | Description |
---|---|---|
VULNERABILITY | true/false | Whether vulnerabilities are found or not |