action.yml

name: "TMAS Scan Action"
description: "Scan container images with Vision One Container Security"
author: "Trend Micro"
inputs:
  TMAS_API_KEY:
    description: "Vision One API Key"
    required: true
  IMAGE:
    description: "Image URI to scan. Not required if you are doing pre-registry scanning. See LOCAL_IMAGE_TARBALL."
    required: false
  REGION:
    description: "Vision One Region"
    required: true
    default: "us-east-1"
  SBOM:
    description: "Decide if you want to save the SBOM file for the image. Default is true."
    required: false
    default: "true"
  MALWARE_SCAN:
    description: "Decide if you want to scan the image for malware. Default is true."
    required: false
    default: "true"
  VULNERABILITY_SCAN:
    description: "Decide if you want to scan the image for vulnerabilities. Default is true."
    required: true
    default: "true"
  SECRETS_SCAN:
    description: "Decide if you want to scan the image for secrets. Default is true."
    required: false
    default: "true"
  MAX_TOTAL:
    description: "Max total of vulnerabilities acceptable in a images"
    required: false
    default: "0"
  MAX_CRITICAL:
    description: "Max critical vulnerabilities acceptable in a images"
    required: false
    default: "0"
  MAX_HIGH:
    description: "Max high vulnerabilities acceptable in a images"
    required: false
    default: "0"
  MAX_MEDIUM:
    description: "Max medium vulnerabilities acceptable in a images"
    required: false
    default: "0"
  MAX_LOW:
    description: "Max low vulnerabilities acceptable in a images"
    required: false
    default: "0"
  MAX_NEGLIGIBLE:
    description: "Max negligible vulnerabilities acceptable in a images"
    required: false
    default: "0"
  MAX_UNKNOWN:
    description: "Max unknown vulnerabilities acceptable in a images"
    required: false
    default: "0"
  SCAN_RESULT_ARTIFACT:
    description: "Name for the artifact generated by the scan in case you want to archive it."
    required: false
    default: "scan-result.json"
  LOCAL_IMAGE_TARBALL:
    description: "Name for the locally available image tarball in case you are doing pre-registry scanning."
    required: false
branding:
  icon: "package"
  color: "red"
runs:
  using: "docker"
  image: "docker://ghcr.io/trendmicro/tmas-scan-action:latest"
  env:
    TMAS_API_KEY: ${{ inputs.TMAS_API_KEY }}
    IMAGE: ${{ inputs.IMAGE }}
    REGION: ${{ inputs.REGION }}
    SBOM: ${{ inputs.SBOM }}
    MALWARE_SCAN: ${{ inputs.MALWARE_SCAN }}
    VULNERABILITY_SCAN: ${{ inputs.VULNERABILITY_SCAN }}
    SECRETS_SCAN: ${{ inputs.SECRETS_SCAN }}
    MAX_TOTAL: ${{ inputs.MAX_TOTAL }}
    MAX_CRITICAL: ${{ inputs.MAX_CRITICAL }}
    MAX_HIGH: ${{ inputs.MAX_HIGH }}
    MAX_MEDIUM: ${{ inputs.MAX_MEDIUM }}
    MAX_LOW: ${{ inputs.MAX_LOW }}
    MAX_NEGLIGIBLE: ${{ inputs.MAX_NEGLIGIBLE }}
    MAX_UNKNOWN: ${{ inputs.MAX_UNKNOWN }}
    SCAN_RESULT_ARTIFACT: ${{ inputs.SCAN_RESULT_ARTIFACT }}
    LOCAL_IMAGE_TARBALL: ${{ inputs.LOCAL_IMAGE_TARBALL }}