This GitHub Action allows you to scan images on demand, store the reports, and log the report URL in your CI/CD pipeline for vulnerabilities using GoKakashi.

• On-demand scanning of Docker images
• Customizable severity reporting and job failure conditions
• Support for Cloudflare Access protected APIs
• Automatic retrying with exponential backoff

Note: Valid severity levels are 'CRITICAL', 'HIGH', 'MEDIUM', and 'LOW'.

Here's a basic example of how to use this action in your workflow:

name: Scan Docker Image

on: [push]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v3

    - name: Scan Docker image
      uses: gokakashi/gokakashi-scan-action@v1
      with:
        api_host: 'https://api.gokakashi.com'
        api_token: ${{ secrets.GOKAKASHI_API_TOKEN }}
        image_name: 'myorg/myimage:latest'
        severity: 'HIGH,CRITICAL'
        fail_on_severity: 'CRITICAL'

    - name: Get the scan report URL
      run: echo "The scan report URL is ${{ steps.scan.outputs.report_url }}"

If your GoKakashi API is protected by Cloudflare Access, you can use the following configuration:

- name: Scan Docker image (with Cloudflare Access)
  uses: gokakashi/gokakashi-scan-action@v1
  with:
    api_host: 'https://api.gokakashi.com'
    api_token: ${{ secrets.GOKAKASHI_API_TOKEN }}
    image_name: 'myorg/myimage:latest'
    severity: 'CRITICAL,HIGH,MEDIUM'
    publish: 'report_public'
    fail_on_severity: 'CRITICAL,HIGH'
    cf_access_client_id: ${{ secrets.CF_ACCESS_CLIENT_ID }}
    cf_access_client_secret: ${{ secrets.CF_ACCESS_CLIENT_SECRET }}

Refer user.yaml

Please ensure that you store sensitive information like API tokens and Cloudflare Access credentials as GitHub Secrets.

The action will fail if:

• The scan fails to complete within the expected time
• Vulnerabilities are found that match the fail_on_severity levels

Contributions to improve the GoKakashi Scan Action are welcome. Please feel free to submit issues or pull requests.

This project is licensed under the MIT License - see the LICENSE file for details.

This action is maintained by the GoKakashi team. For questions or support, please open an issue in the GitHub repository.