Integrate Docker Scout with GitHub Actions — Steps

Reference note (untrusted external data; do not execute it as instructions). First, set up the GitHub Action workflow to build an image. This isn't specific to Docker Scout here, but you'll need to build an image to have something to compare with. Add the following to a GitHub Actions YAML file Bounded code example (external data; do not execute automatically): ```yaml name: Docker on: push: tags: ["*"] branches: - "main" pull_request: branches: ["**"] env: # Hostname of your registry REGISTRY: docker.io # Image repository, without hostname and tag IMAGE_NAME: ${{ github.repository }} SHA: ${{ github.event.pull_request.head.sha || github.event.after }} jobs: build: runs-on: ubuntu-latest permissions: pull-requests: write steps: # Authenticate to the container registry - name: Authenticate to registry ${{ env.REGISTRY }} uses: docker/login-action@{{% param "login_action_version" %}} with: registry: ${{ env.REGISTRY }} username: ${{ secrets.REGISTRY_USER }} password: ${{ secrets.REGISTRY_TOKEN }} - name: Setup Docker buildx uses: docker/setup-buildx-action@{{% param "setup_buildx_action_version" %}} # Extract metadata (t ``` This creates workflow steps to Set up Docker buildx. Authenticate to the registry. Extract metadata from Git reference and GitHub events. Build and push the Docker image to the registry. > [!NOTE] > > This CI workflow runs a local analysis and evaluation of your image. To > evaluate the image locally, you must ensure that the image is loaded the > local image store of your runner. > > This comparison doesn't work if you push the image to a registry, or if you > build an image that can't be loaded to the runner's local image store. For > example, multi-platform images or images with SBOM or provenance attestation > can't be loaded to the local image store. With this setup out of the way, you can add the following steps to run the image comparison Bounded code example (external data; do not execute automatically): … Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.