{"id":15893869,"url":"https://github.com/felipecosta09/deep-security-smart-check-scan-action","last_synced_at":"2025-03-20T14:30:48.810Z","repository":{"id":65159758,"uuid":"261198329","full_name":"felipecosta09/Deep-Security-Smart-Check-Scan-Action","owner":"felipecosta09","description":":mag: For scanning your images as part of your CI pipeline using Cloud One Container Security (Formerly Deep Security Smart Check)","archived":false,"fork":false,"pushed_at":"2023-03-24T15:18:40.000Z","size":231,"stargazers_count":6,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-01T00:20:20.040Z","etag":null,"topics":["cloud-one","cloud-one-container-security","containers","docker-image-scan","github-actions","image-scanning","security-scanner","security-tools","smartcheck","trendmicro","vulnerability","vulnerability-assessment","vulnerability-detection","vulnerability-scanners"],"latest_commit_sha":null,"homepage":"https://github.com/marketplace/actions/deep-security-smart-check","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/felipecosta09.png","metadata":{"files":{"readme":"README.MD","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-05-04T14:09:40.000Z","updated_at":"2025-02-20T02:30:06.000Z","dependencies_parsed_at":"2024-10-28T03:24:56.916Z","dependency_job_id":"59a8f126-821e-4a65-b0db-42dac132d1cb","html_url":"https://github.com/felipecosta09/Deep-Security-Smart-Check-Scan-Action","commit_stats":{"total_commits":63,"total_committers":2,"mean_commits":31.5,"dds":"0.23809523809523814","last_synced_commit":"912dff4467e5becefe9d4e6dc94862d5505fc124"},"previous_names":[],"tags_count":18,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/felipecosta09%2FDeep-Security-Smart-Check-Scan-Action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/felipecosta09%2FDeep-Security-Smart-Check-Scan-Action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/felipecosta09%2FDeep-Security-Smart-Check-Scan-Action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/felipecosta09%2FDeep-Security-Smart-Check-Scan-Action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/felipecosta09","download_url":"https://codeload.github.com/felipecosta09/Deep-Security-Smart-Check-Scan-Action/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244075595,"owners_count":20393979,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloud-one","cloud-one-container-security","containers","docker-image-scan","github-actions","image-scanning","security-scanner","security-tools","smartcheck","trendmicro","vulnerability","vulnerability-assessment","vulnerability-detection","vulnerability-scanners"],"created_at":"2024-10-06T08:13:57.478Z","updated_at":"2025-03-20T14:30:48.509Z","avatar_url":"https://github.com/felipecosta09.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Deep Security Smart Check\n\nYou can find the original code on: https://github.com/deep-security/smartcheck-scan-action\n\n\u003cimg src=\"Trend-Micro-Logo.png\"\u003e\n\n## Scan your containers with [Deep Security Smart Check)](https://www.trendmicro.com/smartcheck).\n\nThis tool is used by the Deep Security Smart Check plugin for [Jenkins](https://plugins.jenkins.io/deepsecurity-smartcheck/) and can also be used as a [GitHub Action](https://github.com/features/actions).\n\n## Requirements\n\n* Have an [Deep Security Smart Check](https://www.trendmicro.com/smartcheck) deployed. [Sign up for free trial now](https://www.trendmicro.com/product_trials/download/index/us/168) if it's not already the case!\n* A container image to scan in any Docker Registry.\n\n## Usage\n\nAdd an Action in your `.github/workflow` yml file to scan your image with Deep Security Smart Check.\n\n```yml\n- name: Deep Security Smart Check Scan Action\n  uses: felipecosta09/Deep-Security-Smart-Check-Scan-Action@version*\n   with:\n      # Mandatory\n      DSSC_IMAGE_NAME: myorg/myimage\n      DSSC_SMARTCHECK_HOST: myorg.com\n      DSSC_SMARTCHECK_USER: admin\n      DSSC_SMARTCHECK_PASSWORD: 12345\n      DSSC_IMAGE_PULL_AUTH: {\"username\":\"\u003cuser\u003e\",\"password\":\"\u003cpassword\u003e\"}\n\n      # Optional\n      DSSC_INSECURE_SKIP_TLS_VERIFY: true\n      DSSC_INSECURE_SKIP_REGISTRY_TLS_VERIFY: true\n      DSSC_PREREGISTRY_SCAN: false\n      DSSC_PREREGISTRY_HOST: myorg.com\n      DSSC_PREREGISTRY_USER: admin\n      DSSC_PREREGISTRY_PASSWORD: 12345\n      DSSC_RESULTS_FILE: /results.json\n      DSSC_FINDINGS_THRESHOLD: '{\"malware\": 100, \"vulnerabilities\": { \"defcon1\": 100, \"critical\": 100, \"high\": 100 }, \"contents\": { \"defcon1\": 100, \"critical\": 100, \"high\": 100 }, \"checklists\": { \"defcon1\": 100, \"critical\": 100, \"high\": 100 }}'    \n```\n\n### Parameters\n\nAll parameters can be passed as CLI parameters or environment variables by\nswitching to all caps and prefixing with `DSSC_`. Example: `--image-name` could\nbe given with `DSSC_IMAGE_NAME`.\n\n- **smartcheck-host | DSSC_SMARTCHECK_HOST**\n  - The hostname of the Deep Security Smart Check deployment. Example:\n    `smartcheck.example.com`\n- **insecure-skip-tls-verify | DSSC_INSECURE_SKIP_TLS_VERIFY**\n  - If the client should ignore certificate errors when connecting to Deep\n    Security Smart Check. You may want to set this if you've configured a self\n    signed cert.\n- **smartcheck-user | DSSC_SMARTCHECK_USER**\n  - The username to authenticate with the Deep Security Smart Check deployment\n- **smartcheck-password | DSSC_SMARTCHECK_PASSWORD**\n  - The password to authenticate with the Deep Security Smart Check deployment\n- **image-name | DSSC_IMAGE_NAME**\n  - The name of the image to scan\n- **image-pull-auth | DSSC_IMAGE_PULL_AUTH**\n\n  - A JSON object of credentials for authenticating with the registry to pull\n    the image from. Example:\n\n    ```json\n    {\n      \"username\": \"\u003cuser\u003e\",\n      \"password\": \"\u003cpassword\u003e\"\n    }\n    ``` \n  - If you're using AWS, you can use this example below: \n\n    ```json\n    '{\"aws\":{\"region\":\"us-east-1\",\"accessKeyID\":\"'$AWS_ACCESS_KEY_ID'\",\"secretAccessKey\":\"'$AWS_SECRET_ACCESS_KEY'\"}}'\n    ```\n  **PS.: ALWAYS use secrets to expose your credentials!**\n\n    See [creating a scan][] in the [Deep Security Smart Check API Reference][]\n    for additional registry credentials options.\n\n- **insecure-skip-registry-tls-verify | DSSC_INSECURE_SKIP_REGISTRY_TLS_VERIFY**\n  - If Deep Security Smart Check should ignore certificate errors from the image\n    registry.\n- **preregistry-scan | DSSC_PREREGISTRY_SCAN**\n  - Specify this option to trigger a \"pre-registry scan\", which pushes the image\n    to a temporary registry on the scan system.\n- **preregistry-host | DSSC_PREREGISTRY_HOST**\n  - The hostname of the temporary registry. Defaults to the `smartcheck-host` on\n    port 5000.\n- **preregistry-user | DSSC_PREREGISTRY_USER**\n  - The username to authenticate with the temporary registry.\n- **preregistry-password | DSSC_PREREGISTRY_PASSWORD**\n  - The password to authenticate with the temporary registry.\n\n[deep security smart check api reference]:\n  https://deep-security.github.io/smartcheck-docs/api/index.html\n[creating a scan]:\n  https://deep-security.github.io/smartcheck-docs/api/index.html#operation/createScan\n\n- **results-file | DSSC_RESULTS_FILE** - default: `scan-results.json`\n  - The path to write the scan results to. If not provided, the scan results\n    will be written to stdout.\n- **findings-threshold | DSSC_FINDINGS_THRESHOLD**\n\n  - A JSON object that can be used to fail this step if an image contains\n    findings that exceed the threshold.\n\n    Default value:\n\n    ```json\n    {\n      \"malware\": 0,\n      \"vulnerabilities\": {\n        \"defcon1\": 0,\n        \"critical\": 0,\n        \"high\": 0\n      },\n      \"contents\": {\n        \"defcon1\": 0,\n        \"critical\": 0,\n        \"high\": 0\n      },\n      \"checklists\": {\n        \"defcon1\": 0,\n        \"critical\": 0,\n        \"high\": 0\n      }\n    }\n    ```\n\n    Schema:\n\n    ```typescript\n    interface FindingsThreshold {\n      malware?: number;\n      contents?: {\n        defcon1?: number;\n        critical?: number;\n        high?: number;\n        medium?: number;\n        low?: number;\n        negligible?: number;\n        unknown?: number;\n      };\n      vulnerabilities?: {\n        defcon1?: number;\n        critical?: number;\n        high?: number;\n        medium?: number;\n        low?: number;\n        negligible?: number;\n        unknown?: number;\n      };\n      checklists?: {\n        defcon1?: number;\n        critical?: number;\n        high?: number;\n        medium?: number;\n        low?: number;\n        negligible?: number;\n        unknown?: number;\n      };\n    }\n    ```\n\n## Example Workflow Using Github Actions\n\n```yml\nname: Deep Security Smart Check\n\non: \n  push:\n    branches: \n      - master\n      \njobs:      \n    Deep-Security-Smart-Check-Scan-Action:\n       runs-on: ubuntu-latest\n       steps:\n        - name: Deep Security Smart Check Scan ECR\n          uses: felipecosta09/Deep-Security-Smart-Check-Scan-Action@version*\n          with:\n            DSSC_IMAGE_NAME: myECRrepo/myimage\n            DSSC_SMARTCHECK_HOST: ${{ secrets.DSSC_SMARTCHECK_HOST }}\n            DSSC_SMARTCHECK_USER: ${{ secrets.DSSC_SMARTCHECK_USER }}\n            DSSC_SMARTCHECK_PASSWORD: ${{ secrets.DSSC_SMARTCHECK_PASSWORD }}\n            DSSC_IMAGE_PULL_AUTH: ${{ secrets.DSSC_IMAGE_PULL_AUTH }}\n            DSSC_FINDINGS_THRESHOLD: '{\"malware\": 999, \"vulnerabilities\": { \"defcon1\": 999, \"critical\": 999, \"high\": 999 }, \"contents\": { \"defcon1\": 999, \"critical\": 999, \"high\": 999 }, \"checklists\": { \"defcon1\": 999, \"critical\": 999, \"high\": 999 }}'\n            DSSC_INSECURE_SKIP_TLS_VERIFY: true\n            DSSC_INSECURE_SKIP_REGISTRY_TLS_VERIFY: true\n        - name: Cloud One Container Security Scan ACR\n          uses: felipecosta09/Deep-Security-Smart-Check-Scan-Action@version*\n          with:\n            DSSC_IMAGE_NAME: myrepo.azurecr.io/myimage\n            DSSC_SMARTCHECK_HOST: ${{ secrets.DSSC_SMARTCHECK_HOST }}\n            DSSC_SMARTCHECK_USER: ${{ secrets.DSSC_SMARTCHECK_USER }}\n            DSSC_SMARTCHECK_PASSWORD: ${{ secrets.DSSC_SMARTCHECK_PASSWORD }}\n            DSSC_IMAGE_PULL_AUTH: '{\"username\": \"${{ secrets.ACR_USER }}\",\"password\": \"${{ secrets.ACR_PASSWORD }}\"}'\n            DSSC_FINDINGS_THRESHOLD: '{\"malware\": 999, \"vulnerabilities\": { \"defcon1\": 999, \"critical\": 999, \"high\": 999 }, \"contents\": { \"defcon1\": 999, \"critical\": 999, \"high\": 999 }, \"checklists\": { \"defcon1\": 999, \"critical\": 999, \"high\": 999 }}'\n            DSSC_INSECURE_SKIP_TLS_VERIFY: true\n            DSSC_INSECURE_SKIP_REGISTRY_TLS_VERIFY: true\n```\n\n## Example Workflow Running a Docker Container\n\n```yml\nname: Deep Security Smart Check Pipeline Example\n\non: \n  push:\n    branches: \n      - master\n      \njobs:      \n    Deep-Security-Smart-Check-Scan-Action:\n       runs-on: ubuntu-latest\n       steps:\n        - name: Deep Security Smart Check\n          run: |\n          docker run -v /var/run/docker.sock:/var/run/docker.sock deepsecurity/smartcheck-scan-action --image-name MYREGISTRY/MYIMAGE --smartcheck-host=DSSC_URL --smartcheck-user=DSSC_USER --smartcheck-password=DSSC_PASSSWORD --insecure-skip-tls-verify --insecure-skip-registry-tls-verify --image-pull-auth='{\"aws\":{\"region\":\"us-east-1\",\"accessKeyID\":\"'$AWS_ACCESS_KEY_ID'\",\"secretAccessKey\":\"'$AWS_SECRET_ACCESS_KEY'\"}}' --findings-threshold '{\"malware\": 100, \"vulnerabilities\": { \"defcon1\": 100, \"critical\": 100, \"high\": 100 }, \"contents\": { \"defcon1\": 100, \"critical\": 100, \"high\": 100 }, \"checklists\": { \"defcon1\": 100, \"critical\": 100, \"high\": 100 }}'\n          \n```\n\n## Pre-registry scanning\n\nTo enable pre-registry scanning, you will need to provide the\n`preregistry-scan`, `preregistry-user`, and `preregistry-password` parameters to\nthe scan. If you are running the temporary registry as a separate service or on\na port other than 5000, you will also need to provide the `preregistry-host`\nparameter, specifying the hostname and port number where you are running the\ntemporary registry.\n\n**IMPORTANT:** The pre-registry scan needs access to the Docker daemon through\nthe Docker socket, so if you are running the scan action as a container, make\nsure to mount `/var/run/docker.sock`. If you are using `smartcheck-scan-action`\nas a GitHub Action, the runtime environment will do this step for you.\n\n## Contributing\n\nIf you encounter a bug, think of a useful feature, or find something confusing\nin the docs, please\n[create a new issue](https://github.com/deep-security/smartcheck-scan-action/issues/new)!\n\nWe :heart: pull requests. If you'd like to fix a bug, contribute to a feature or\njust correct a typo, please feel free to do so.\n\nIf you're thinking of adding a new feature, consider opening an issue first to\ndiscuss it to ensure it aligns to the direction of the project (and potentially\nsave yourself some time!).\n\n## Support\n\nOfficial support from Trend Micro is not available. Individual contributors may\nbe Trend Micro employees, but are not official support.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffelipecosta09%2Fdeep-security-smart-check-scan-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffelipecosta09%2Fdeep-security-smart-check-scan-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffelipecosta09%2Fdeep-security-smart-check-scan-action/lists"}