anchore / anchore/scan-action

Having the action report only certain level of vulnerabilities and above

Open
#321 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
JavaScript
Stars
287
Forks
95
Avg merge
13h 23m
Merged PRs (30d)
13

Description

I know there is the `severity-cutoff: ` option for making the GHA workflow fail if vulnerabilities of a `` and above are found.

Is there a way however to configure the action to also only report vulnerabilities of a base level and above? The output is kind of overwhelming.

Contributor guide

Open the contributing guide

Research direction

Start by reading how the GitHub Action handles the existing `severity-cutoff` option and how vulnerabilities are selected for workflow output. Determine whether a separate reporting cutoff can be defined without changing the failure cutoff, then verify that only vulnerabilities at the configured base level and above appear in the action output.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, javascript
Domain
ci-cd, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.