action.yaml

---
name: "Docker scout action"
description: |
  "Run Docker Scout comparing a recent built version with a released version"
inputs:
  docker_username:
    description: "Docker username"
    required: true
  docker_password:
    description: "Docker password"
    required: true
  docker_project_repo:
    description: "Repository on Docker Hub, for example `company/project-foo`"
    required: true
  release_tag_regex:
    description: "Regex to match the latest GitHub release used for comparison"
    required: true
  image_name:
    required: true
    description: "Image name that was built and exists locally"
  github_token:
    required: true
    description: "Token required to publish report into pull request as a comment"

runs:
  using: "composite"
  steps:
    - name: Log in to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ inputs.docker_username }}
        password: ${{ inputs.docker_password }}

    - name: Get latest release
      id: latest_tag
      uses: resuelve/latest-release-tag-action@master
      with:
        github_token: ${{ inputs.github_token }}
        regex: ${{ inputs.release_tag_regex }}

    - name: Docker Scout
      uses: docker/scout-action@v1
      with:
        command: compare,cves
        image: ${{ inputs.image_name }}
        to: "${{ inputs.docker_project_repo }}:${{ steps.latest_tag.outputs.tag }}"
        ignore-unchanged: false
        only-severities: critical,high
        github-token: ${{ inputs.github_token }}
        write-comment: true