github-action icon indicating copy to clipboard operation
github-action copied to clipboard

Impossible to scan private image from Github registry

Open FloRichardAloeCorp opened this issue 8 months ago • 5 comments

Hello, I can't scan a private image that is stored in ghcr.io.

I've verified the credentials.

Here is the pipeline:

name: Deploy to dev env

on:
  push:
    branches: ["dev"]
  pull_request:
    branches: ["dev"]

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
      security-events: write
      actions: read
    steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: kubescape/github-action@main
        continue-on-error: true
        with:
          image: ghcr.io/beltsecurity/fleet-qc:dev
          format: sarif
          outputFile: results.sarif
          registryUsername: ${{ github.actor }}
          registryPassword: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload Kubescape scan results to Github Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: ghcr.io/beltsecurity/fleet-qc:dev

The pipeline step kubescape/github-action@main outputs the following error:

Error: unable to load image: unable to use OciRegistry source: failed to get image descriptor from registry: GET https://auth.docker.io/token?scope=repository%3A%2F%2Fghcr.io%2Fbeltsecurity%2Ffleet-qc%3Apull&service=registry.docker.io: unexpected status code 401 Unauthorized: {"details":"incorrect username or password"}

I think that URL of the targeted registry is wrong.

FloRichardAloeCorp avatar Jun 19 '24 15:06 FloRichardAloeCorp