Vulnerability Scan GitHub Action for Amazon Inspector

Amazon Inspector is a vulnerability management service that scans AWS workloads and CycloneDX SBOMs for known software vulnerabilities.

This GitHub Action allows you to scan supported artifacts for software vulnerabilities using Amazon Inspector from your GitHub Actions workflows.

An active AWS account is required to use this action.

Overview

This action works by first generating a CycloneDX software bill of materials (SBOM) for the provided artifact. The SBOM is then sent to Amazon Inspector and scanned for known vulnerabilities.

This action can scan the following artifact types for vulnerabilities:

Files and directories in your GitHub repository
Container images
Compiled Go and Rust binaries (stripped and obfuscated binaries are not supported)
Archives (.zip, .tar, .tar.gz)

For more information, please refer to Amazon Inspector's supported artifacts and container operating systems.

To learn more about Amazon Inspector, as well as Inspector's free trial and pricing model, please see the links below:

Prerequisites

Required: You must have an active AWS account to use this action. Guidance on creating an AWS account is provided here.
Required: You must have read access to the InspectorScan:ScanSbom API. See here for configuration instructions .
Required: You must configure AWS authentication for use in GitHub action workflows. We recommend using configure-aws-credentials for this purpose.
Required: Create a GitHub Actions workflow if you do not already have one. Guidance on doing so is available here.
Required: Configure Dependabot to keep this action up to date so you receive the latest bug fixes and security updates. Guidance on doing so is available here .
Optional: Configure container registry authentication if needed. GitHub Actions are available for this purpose including Docker Login.
Runner requirements: This action runs directly on a Linux runner with Python 3.10 or later (including the venv module) and network access to PyPI, where it installs the AWS SDK for Python (boto3) at runtime. GitHub-hosted Ubuntu runners meet these requirements; Docker is not required.

Usage

Quick Start

Perform the following steps to quickly add this action to your GitHub Actions pipeline:

Copy and paste the following YAML block into your workflow file.

Read through this workflow definition and make changes to suit your environment:

name: Scan artifact with Amazon Inspector
on: [push]
jobs:
 daily_job:
   runs-on: ubuntu-latest

   # change this to match your GitHub Secrets environment
   environment:
     name: your_github_secrets_environment

   steps:

     # modify this block based on how you authenticate to AWS
     # make sure you have permission to access the Inspector ScanSbom API
     # https://docs.aws.amazon.com/inspector/latest/user/configure-cicd-account.html#cicd-iam-role
     - name: Configure AWS credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
         aws-region: "us-east-1"
         role-to-assume: "arn:aws:iam::<AWS_ACCOUNT_ID>:role/<IAM_ROLE_NAME>"

     # Check out your repository if needed
     - name: Checkout this repository
       uses: actions/checkout@v4

     # modify this block to scan your intended artifact
     - name: Inspector Scan
       id: inspector
       uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
       with:
         # change artifact_type to either 'repository', 'container', 'binary', or 'archive'.
         artifact_type: 'repository'

         # change artifact_path to the file path or container image you would like to scan.
         # File paths should be relative to your root project directory.
         # For containers, this action accepts 'docker pull'-style references to containers,
         # such as 'alpine:latest' or a file path to an image exported as TAR using docker save.
         artifact_path: './'

         # If enabled, this setting will display Inspector's vulnerability scan findings
         # as a GitHub actions step summary. See here for an example step summary:
         # https://github.com/aws-actions/vulnerability-scan-github-action-for-amazon-inspector/actions/runs/8800085041
         display_vulnerability_findings: "enabled"

         # Set vulnerability thresholds; if the number of vulnerabilities is
         # equal to or greater than any of the specified thresholds, this
         # action will set the 'vulnerability_threshold_exceeded'
         # output flag to 1.
         critical_threshold: 1
         high_threshold: 1
         medium_threshold: 1
         low_threshold: 1
         other_threshold: 1

         # Additional input arguments are available to control scan behavior.
         # See 'action.yml' for additional input/output options.


     # The following steps illustrate how to
     # display scan results in the GitHub Actions job terminal.
     - name: Display CycloneDX SBOM (JSON)
       run: cat ${{ steps.inspector.outputs.artifact_sbom }}

     - name: Display Inspector vulnerability scan results (JSON)
       run: cat ${{ steps.inspector.outputs.inspector_scan_results }}

     - name: Display Inspector vulnerability scan results (CSV)
       run: cat ${{ steps.inspector.outputs.inspector_scan_results_csv }}

     - name: Display Inspector vulnerability scan results (Markdown)
       run: cat ${{ steps.inspector.outputs.inspector_scan_results_markdown }}


     # The following steps illustrate how to
     # upload scan results as a GitHub actions job artifact
     - name: Upload Scan Results
       uses: actions/upload-artifact@v4
       with:
         name: Inspector Vulnerability Scan Artifacts
         path: |
           ${{ steps.inspector.outputs.inspector_scan_results }}
           ${{ steps.inspector.outputs.inspector_scan_results_csv }}
           ${{ steps.inspector.outputs.artifact_sbom }}
           ${{ steps.inspector.outputs.inspector_scan_results_markdown }}


       # This step illustrates how to add custom logic if
       # the vulnerability threshold is exceeded. This example
       # simply prints the 'vulnerability_threshold_exceeded' value
       # to the GitHub actions job terminal.
       # Replace 'echo' with 'exit' if you want to fail the job.
     - name: On vulnerability threshold exceeded
       run: echo ${{ steps.inspector.outputs.vulnerability_threshold_exceeded }}

Save your workflow file, then git commit / git push the workflow to GitHub.

GitHub should automatically run your new workflow; review its results and make any needed changes to the input and output arguments.

For additional examples, see this repository's workflow definitions.

Configuring Vulnerability Scan Outputs

By default, this action only displays the number of vulnerabilities detected in the GitHub Actions job terminal. Detailed findings are optional and configurable as JSON, CSV, or Markdown. In addition, an artifact inventory is available as a CycloneDX JSON file.

The below example shows how to enable action outputs in various locations and formats.

Exercise caution to ensure you do not accidentally post vulnerability information to untrusted viewers.

- name: Scan container
  id: inspector
  uses: aws/vulnerability-scan-github-action-for-amazon-inspector@v1
  with:
    artifact_type: 'container'
    artifact_path: 'ubuntu:14.04'
    display_vulnerability_findings: "enabled"

# Display Inspector results in the GitHub Actions terminal
- name: Display CycloneDX SBOM (JSON)
  run: cat ${{ steps.inspector.outputs.artifact_sbom }}

- name: Display Inspector vulnerability scan results (JSON)
  run: cat ${{ steps.inspector.outputs.inspector_scan_results }}

- name: Display Inspector vulnerability scan results (CSV)
  run: cat ${{ steps.inspector.outputs.inspector_scan_results_csv }}

- name: Display Inspector vulnerability scan results (markdown)
  run: cat ${{ steps.inspector.outputs.inspector_scan_results_markdown }}


# Upload Inspector outputs as a .zip that can be downloaded
# from the GitHub actions job summary page.
- name: Upload Scan Results
  id: inspector
  uses: actions/upload-artifact@v4
  with:
  path: |
    ${{ steps.inspector.outputs.inspector_scan_results }}
    ${{ steps.inspector.outputs.inspector_scan_results_csv }}
    ${{ steps.inspector.outputs.artifact_sbom }}

Publishing to GitHub Code Scanning

The action can emit findings in SARIF format, which GitHub Code Scanning ingests to display vulnerabilities in your repository's Security tab — no custom parsing required.

SARIF generation is opt-in: set output_sarif_path to enable it. Uploading is delegated to GitHub's first-party github/codeql-action/upload-sarif action — the same way AWS authentication is delegated to configure-aws-credentials. The action produces the SARIF file; you wire it to the upload step.

permissions:
  id-token: write          # for AWS authentication (OIDC)
  contents: read
  security-events: write   # required to upload results to Code Scanning

steps:
  - uses: actions/checkout@v4

  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.INSPECTOR_ROLE_ARN }}
      aws-region: us-east-1

  - name: Scan with Amazon Inspector
    id: inspector
    uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
    with:
      artifact_type: 'repository'
      artifact_path: './'
      output_sarif_path: 'inspector.sarif'   # enables SARIF generation

  - name: Upload to GitHub Code Scanning
    uses: github/codeql-action/upload-sarif@v3
    with:
      sarif_file: ${{ steps.inspector.outputs.inspector_scan_results_sarif }}

Notes:

Findings appear under Security → Code scanning keyed by vulnerability ID (e.g. CVE), with severity ranking derived from the CVSS score.
Findings suppressed via the ignore list are excluded from the SARIF, consistent with the other report formats.
security-events: write is required by the upload step; Code Scanning is available on public repositories and on private repositories with GitHub Advanced Security.

Configuring Vulnerability Thresholds

Vulnerability thresholds let you decide what happens when a scan finds too many vulnerabilities of a given severity.

The action itself does not fail when a threshold is exceeded. It sets the vulnerability_threshold_exceeded output to 1 if the number of vulnerabilities at any severity is equal to or greater than that severity's threshold, and to 0 otherwise. A threshold of 0 disables the check for that severity.

The example below fails the job when one or more critical, high, or medium vulnerabilities are found:

- name: Invoke Amazon Inspector Scan
  id: inspector
  uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
  with:
    artifact_type: 'repository'
    artifact_path: './'
    display_vulnerability_findings: "enabled"
    critical_threshold: 1
    high_threshold: 1
    medium_threshold: 1
    low_threshold: 0
    other_threshold: 0

- name: Fail if vulnerability threshold exceeded
  if: steps.inspector.outputs.vulnerability_threshold_exceeded == '1'
  run: exit 1

The same if: condition can guard any later step, so you can skip a deployment or post a notification instead of failing the job:

- name: Deploy
  if: steps.inspector.outputs.vulnerability_threshold_exceeded == '0'
  run: ./deploy.sh

Blocking Malicious Packages

Amazon Inspector flags packages that are known to be malicious (for example, compromised releases published to a package registry). These findings appear in a dedicated malware section of the step summary. To fail the scan step automatically when Inspector reports any malicious package, set fail_on_malicious_packages:

- name: Inspector Scan
  id: inspector
  uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
  with:
    artifact_type: 'repository'
    artifact_path: './'
    fail_on_malicious_packages: true

# The scan step fails when a malicious package is found, so use
# if: always() on steps that should still run, such as uploading reports.
- name: Upload Scan Results
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: Inspector Scan Results
    path: |
      ${{ steps.inspector.outputs.inspector_scan_results }}
      ${{ steps.inspector.outputs.inspector_malware_scan_results_markdown }}

How it behaves:

Off by default. Without this input, malicious packages are reported but never fail the step.
Only true or false. Any letter case is accepted. Any other value, such as yes, 1, or an empty string, fails the step right away instead of silently leaving the check off:
```
Error: fail_on_malicious_packages must be 'true' or 'false' (received: 'yes')
```
No malicious packages: the step succeeds as usual.

One or more malicious packages: the action writes every report and sets every output first, then exits with a nonzero status, which fails the step. The log shows:

level=error msg="Amazon Inspector reported 1 malicious package(s); failing because fail_on_malicious_packages is enabled (ignore_findings and .inspector-ignore do not apply to this check)"

Ignore lists do not apply. Listing a malicious finding in ignore_findings or .inspector-ignore does not stop the step from failing. The ignored finding is still removed from the reports, so the malware section can say no malware was found while the step fails; the error above is the signal.
Fails closed. If the scan results do not include Inspector's malicious-package count, the action still writes every report and sets every output, then fails the step rather than assuming the artifact is clean:
```
level=error msg="fail_on_malicious_packages is enabled, but the malicious package count could not be read from the Amazon Inspector scan results"
```

This check is independent of the severity thresholds and vulnerability_threshold_exceeded. Every failure message above also appears as an error annotation on the workflow run page, so you can see why the step failed without opening the log. See Blocking malicious packages for the full guide.

Ignoring Specific Findings

You can suppress specific findings so they are excluded from reports and do not count towards vulnerability thresholds.

There are two ways to define findings to ignore, and both can be combined:

1. ignore_findings input parameter — provide a comma-separated list of finding IDs (CVE, GHSA, etc.) directly in the workflow:

- name: Inspector Scan
  id: inspector
  uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
  with:
    artifact_type: 'repository'
    artifact_path: './'
    critical_threshold: 1
    ignore_findings: "CVE-2021-12345,CVE-2022-67890,GHSA-mqqf-5wvp-8fh8"

2. .inspector-ignore file — place a plain text file named .inspector-ignore at the root of your repository (the workflow's working directory — the same place you'd keep .gitignore). The file is read regardless of which artifact type is being scanned. One finding ID per line; lines starting with # and inline # comments are ignored:

# .inspector-ignore
CVE-2021-12345  # accepted risk: no fix available, mitigated by network controls
CVE-2022-67890
GHSA-abcd-1234-efgh

Time-bounded ignores (snooze): to ignore a finding only until a fix is expected, add SNOOZE:YYYY-MM-DD to the entry's inline comment (a space after the colon is fine, as in SNOOZE: 2026-10-31). The finding stays ignored through that date (inclusive, in UTC). From the next day on it appears in reports and counts toward thresholds again, and the action logs a warning so you know to remove or extend the entry:

# .inspector-ignore
CVE-2026-5450   # SNOOZE:2026-10-31 waiting on the Debian backport
CVE-2021-12345  # accepted risk: no fix available

level=warning msg="./.inspector-ignore: snooze for CVE-2026-5450 expired on 2026-10-31; finding will not be ignored"

The warning also appears as an annotation on the workflow run page, as do warnings about entries the action could not apply (an unreadable .inspector-ignore, malformed finding IDs, or malformed snoozes).

If an entry's comment mentions "snooze" (in any letter case) anywhere other than in a single well-formed SNOOZE:YYYY-MM-DD, the finding is not ignored and a warning is logged. Some examples: SNOOZE 2026-10-31 without the colon, SNOOZE : 2026-10-31 with a space before the colon, snoozed until 2026-10-31, an impossible date such as SNOOZE:2026-02-30, or a comment that mentions snooze twice. This means a typo can't silently turn a time-bounded ignore into a permanent one. Snooze applies only to the .inspector-ignore file. IDs in the ignore_findings input are always ignored, and an ID listed without a snooze anywhere stays ignored even if another entry for it has expired. See Snoozing findings until a date for the full guide.

Findings listed in either location are removed from all output reports (JSON, CSV, Markdown) and are not counted when evaluating vulnerability thresholds.

Build and Scan Container Images

This action supports a common use case that entails building a container image, scanning the built image for vulnerabilities, and optionally, failing the workflow before the image is deployed to a container registry or elsewhere.

We provide an example of this workflow below. You must modify this workflow to suit your environment:

name: Build & Scan Container Image

on: [ push ]

jobs:
  build:
    name: Build docker image
    runs-on: ubuntu-latest
    environment:
      # change this to match your GitHub secrets environment
      name: plugin-development

    steps:
      # checkout the repository containing our Dockerfile
      - name: Checkout this repository
        uses: actions/checkout@v4

      # Setup prerequisites for docker/build-push-action
      - name: Set up docker build prereqs (QEMU)
        uses: docker/setup-qemu-action@v3

      - name: Set up docker build prereqs (Buildx)
        uses: docker/setup-buildx-action@v3

      # build the image you wish to scan
      - name: Build Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          push: false
          tags: app:latest
          load: true

      # setup your AWS credentials
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: "us-east-1"
          role-to-assume: "arn:aws:iam::<AWS_ACCOUNT_ID>:role/<IAM_ROLE_NAME>"

      - name: Scan built image with Inspector
        uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
        id: inspector
        with:
          artifact_type: 'container'
          artifact_path: 'app:latest' # make sure this matches the image you built
          critical_threshold: 1
          high_threshold: 1
          medium_threshold: 1
          low_threshold: 1
          other_threshold: 1
          # set additional arguments as needed

      - name: Fail job if vulnerability threshold is exceeded
        run: exit ${{ steps.inspector.outputs.vulnerability_threshold_exceeded }}

        # add any additional steps for deploying your image

Action Inputs and Outputs

The following input and output options are provided by this action. See action.yml for more detail.

Input Options

Name	Description	Required	Default
artifact_type	The artifact you would like to scan with Amazon Inspector. Valid choices are "repository", "container", "binary", or "archive".	True	repository
artifact_path	The file path to the artifact you would like to scan with Amazon Inspector. File paths are relative to the root project directory. If scanning a container image, you must provide a value that follows the docker pull convention. For example, "alpine:latest", or a path to an image exported as tarball using "docker save".	True	./
display_vulnerability_findings	If set to "enabled", the action will display detailed vulnerability findings in the action summary page; see here for an example: https://github.com/aws-actions/vulnerability-scan-github-action-for-amazon-inspector/actions/runs/8742638284/attempts/1#summary-23991378549	True	disabled
output_sbom_path	The destination file path for the generated SBOM.	False	./sbom_${{ github.run_id }}.json
output_inspector_scan_path	The destination file path for Inspector's vulnerability scan (JSON format).	False	inspector_scan_${{ github.run_id }}.json
output_inspector_scan_path_csv	The destination file path for Inspector's vulnerability scan (CSV format).	False	inspector_scan_${{ github.run_id }}.csv
output_inspector_scan_path_markdown	The destination file path for Inspector's vulnerability scan (markdown format).	False	inspector_scan_${{ github.run_id }}.md
output_sarif_path	The destination file path for Inspector's vulnerability scan (SARIF format). SARIF is generated only when this value is set. Provide the resulting file to `github/codeql-action/upload-sarif` to publish findings to GitHub Code Scanning. See Publishing to GitHub Code Scanning.	False	'' (disabled)
sbomgen_version	The inspector-sbomgen version you wish to use for SBOM generation. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	False	latest
critical_threshold	Specifies the number of critical vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	False	0
high_threshold	Specifies the number of high vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	False	0
medium_threshold	Specifies the number of medium vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	False	0
low_threshold	Specifies the number of low vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	False	0
other_threshold	Specifies the number of other vulnerabilities needed to set the 'vulnerability_threshold_exceeded' flag.	False	0
fail_on_malicious_packages	If set to `true`, the scan step fails when Amazon Inspector reports one or more malicious packages, after all reports and outputs are written. Ignore lists do not apply. Accepts only `true` or `false`; any other value fails the step. See Blocking Malicious Packages.	False	false
scanners	Specifies the file scanners that you would like inspector-sbomgen to execute. By default, inspector-sbomgen will try to run all file scanners that are applicable to the target artifact. If this argument is set, inspector-sbomgen will only execute the specified file scanners. Provide your input as a single string. Separate each file scanner with a comma. For example: scanners: dpkg,python-requirements,javascript-npm-packagelock To view a list of available file scanners, execute 'inspector-sbomgen list-scanners'. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	False	''
skip_scanners	Specifies a list of file scanners that should NOT be executed; this argument cannot be combined with 'scanners'. If this argument is set, inspector-sbomgen will execute all file scanners except those you specified. Provide your input as a single string. Separate each file scanner with a comma. For example: skip_scanners: 'binaries,alpine-apk,dpkg,php'To view a list of available file scanners, execute 'inspector-sbomgen list-scanners'. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	False	''
additional_scanners	Enables additional (opt-in) file scanners that inspector-sbomgen does not run by default. Provide your input as a single string. Separate each file scanner with a comma. To view a list of available file scanners, execute 'inspector-sbomgen list-scanners'. See here for more info: https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html	False	''
skip_files	Specifies one or more files and/or directories that should NOT be inventoried. Separate each file with a comma and enclose the entire string in double quotes, for example: skip_files: "./media,/tmp/foo/,/bar/my_program"	False	''
plugin_dir	Path to a directory containing custom Lua plugins for inspector-sbomgen to load (file discovery and package collection). The path is resolved inside the action container, so it should be within your checked-out workspace.	False	''
skip_nested_pomxml	If set to `true`, inspector-sbomgen will not collect dependencies declared in `pom.xml` files that are nested inside compiled jar archives.	False	false
timeout	Specifies a timeout in seconds. If this timeout is exceeded, the action will gracefully conclude and present any findings discovered up to that point. Default value is 600 seconds or 10 minutes.	False	600
max_file_size	Skip files larger than this many bytes during directory traversal. Set to 0 (the default) to disable the limit.	False	0
max_read_file_size	Cap a single buffered file read at this many bytes to prevent out-of-memory conditions. Set to 0 to disable the cap. -1 (the default) leaves inspector-sbomgen's built-in default in effect.	False	-1
depth	Limit directory traversal to the specified recursion depth. Set to -1 (the default) to leave inspector-sbomgen's built-in recursion behavior in effect.	False	-1
ignore_findings	A comma-separated list of finding IDs to suppress. Ignored findings are excluded from all output reports and do not count towards vulnerability thresholds. You can also place a plain-text `.inspector-ignore` file at the root of your repository (the workflow's working directory; one ID per line, `#` for comments, optional `SNOOZE:YYYY-MM-DD` in a comment to ignore until a date). See Ignoring Specific Findings. Example: `CVE-2021-12345,CVE-2022-67890,GHSA-mqqf-5wvp-8fh8`	False	''
license_collection	If set to `true`, inspector-sbomgen collects SPDX license metadata during SBOM generation and the action renders a license inventory report (CSV and markdown), also posting it to the step summary. License collection is supported for select ecosystems; the report is empty for unsupported ecosystems.	False	false
collect_ml_models	If set to `true`, inspector-sbomgen scans for machine learning models (e.g., Hugging Face) during SBOM generation.	False	false
enable_debug_props	If set to `true`, inspector-sbomgen adds debug properties to the SBOM (such as source file scanners and package collectors) to aid troubleshooting.	False	false
debug_file_paths	If set to `true`, inspector-sbomgen emits per-path directory-walk debug logging. Applies to repository/directory, archive, and volume scans.	False	false

Output Options

Name	Description
artifact_sbom	The file path to the artifact's software bill of materials.
inspector_scan_results	The file path to the Inspector vulnerability scan findings in JSON format.
inspector_scan_results_csv	The file path to the Inspector vulnerability scan findings in CSV format.
inspector_scan_results_markdown	The file path to the Inspector vulnerability scan findings in markdown format.
inspector_scan_results_sarif	The file path to the Inspector vulnerability scan findings in SARIF format. Produced only when `output_sarif_path` is set. Pass to `github/codeql-action/upload-sarif`.
inspector_dockerfile_scan_results_csv	The file path to the Inspector Dockerfile vulnerability scan findings in CSV format.
inspector_dockerfile_scan_results_markdown	The file path to the Inspector Dockerfile vulnerability scan findings in markdown format.
inspector_dockerile_scan_results_csv	Deprecated, misspelled alias of `inspector_dockerfile_scan_results_csv`. Still set for existing workflows; use the correctly spelled output.
inspector_dockerile_scan_results_markdown	Deprecated, misspelled alias of `inspector_dockerfile_scan_results_markdown`. Still set for existing workflows; use the correctly spelled output.
inspector_malware_scan_results_markdown	The file path to the Inspector malware (known-compromised package) findings in markdown format. These are surfaced in a dedicated step-summary section, separate from CVE, Dockerfile, and license findings.
inspector_license_results_csv	The file path to the collected license inventory in CSV format. Produced only when `license_collection` is enabled.
inspector_license_results_markdown	The file path to the collected license inventory in markdown format. Produced only when `license_collection` is enabled.
vulnerability_threshold_exceeded	This variable is set to 1 if any vulnerability threshold was exceeded, otherwise it is 0. This variable can be used to trigger custom logic, such as failing the job if vulnerabilities were detected.

Get Help

For general questions about this action, please post your question to the project's discussion page:

https://github.com/aws-actions/vulnerability-scan-github-action-for-amazon-inspector/discussions

You may also consider exploring these resources for additional help with AWS products and services:

https://repost.aws/knowledge-center/get-aws-help

Bugs

If you encountered a bug, please open a GitHub issue:

https://github.com/aws-actions/vulnerability-scan-github-action-for-amazon-inspector/issues/new/choose

Contributing

Contributions are welcome. This project uses a proposal-first workflow: before opening a substantive pull request, please open a Feature Proposal issue so we can align on the change and, if accepted, assign it to you. Trivial fixes (typos, one-line doc changes, broken links) may be submitted directly as a pull request against the develop branch.

See CONTRIBUTING.md for the full guidelines.

Security

See CONTRIBUTING for more information.

License

This project is licensed under the MIT license.

This project leverages the Amazon Inspector SBOM Generator, which is distributed under the AWS Intellectual Property License.

Name		Name	Last commit message	Last commit date
.github		.github
docs/features		docs/features
entrypoint		entrypoint
test_fixtures/sbomgen-flags		test_fixtures/sbomgen-flags
validator		validator
.gitignore		.gitignore
AGENTS.md		AGENTS.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE		LICENSE
Makefile		Makefile
NOTICE		NOTICE
README.md		README.md
SECURITY.md		SECURITY.md
action.yml		action.yml

Navigation Menu

Repository navigation

About

Repository files navigation

Vulnerability Scan GitHub Action for Amazon Inspector

Overview

Prerequisites

Usage

Quick Start

Configuring Vulnerability Scan Outputs

Publishing to GitHub Code Scanning

Configuring Vulnerability Thresholds

Blocking Malicious Packages

Ignoring Specific Findings

Build and Scan Container Images

Action Inputs and Outputs

Input Options

Output Options

Get Help

Bugs

Contributing

Security

License

About

Releases

Used by

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

Vulnerability Scan GitHub Action for Amazon Inspector

Overview

Prerequisites

Usage

Quick Start

Configuring Vulnerability Scan Outputs

Publishing to GitHub Code Scanning

Configuring Vulnerability Thresholds

Blocking Malicious Packages

Ignoring Specific Findings

Build and Scan Container Images

Action Inputs and Outputs

Input Options

Output Options

Get Help

Bugs

Contributing

Security

License

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Used by

Contributors

Languages