Version updated for https://github.com/skaldlab/muninn to version v0.3.6. This action is used across all versions by 1 repositories. Action Type This is a Docker action. Go to the GitHub Marketplace to find the latest changes. Action Summary Muninn is an open-source security scanning tool designed to integrate with GitHub Actions workflows. It automates the process of identifying vulnerabilities across various tools, normalizes their output, and presents findings in a unified format as comments on pull requests, SARIF uploads, and structured JSON. Muninn uses eight popular vulnerability scanners to detect secrets, pipeline misconfigurations, syntax errors, supply chain risks, application SAST issues, dependency vulnerabilities, container image vulnerabilities, and infrastructure-as-code misconfigurations, providing a comprehensive security scan of GitHub Actions pipelines and self-hosted CI environments.

Version updated for https://github.com/skaldlab/muninn to version v0.3.5. This action is used across all versions by 1 repositories. Action Type This is a Docker action. Go to the GitHub Marketplace to find the latest changes. Action Summary Muninn is an open-source security scanner that integrates multiple best-in-class tools into a single workflow, automating security checks and reporting unified findings as GitHub PR comments, SARIF uploads, and structured JSON. It normalizes scanner outputs, collapses duplicate findings across different scanners, and provides attribution for each scan, improving visibility and reliability in CI/CD pipelines.

Version updated for https://github.com/skaldlab/muninn to version v0.3.4. This action is used across all versions by 1 repositories. Action Type This is a Docker action. Go to the GitHub Marketplace to find the latest changes. What’s Changed Changelog [0.3.4] - 2026-07-04 Changed Docker image scanner updates: osv-scanner 2.4.0, trivy 0.72.0, semgrep 1.168.0, zizmor 1.26.1 (checkov remains at 3.2.531 pending aiohttp cap lift). [0.3.3] - 2026-06-17 Changed Trivy default severity is now all levels (UNKNOWN through CRITICAL) instead of CRITICAL and HIGH only. osv-scanner and trivy now overlap on medium/low advisories by default so cross-scanner dedup and Detected by work without extra config. Consumers can narrow the Trivy scan with scanners.trivy.severity; fail-on still controls which findings fail the run. [0.3.2] - 2026-06-16 Fixed Suppressions with tool and/or rule-id are now applied. Previously only id (path substring) and fingerprint matchers worked; tool+rule-id entries parsed from muninn.yml but silently no-op’d. [0.3.1] - 2026-06-16 Fixed Poutine v1.x JSON parsing: findings from poutine 1.1.6+ (rule_id, meta, rules, blobshas) now populate title, rule, and file in PR comments instead of empty shells (File: :0, `Rule: ``) (#41). Actionlint PR comments: fall back to kind (e.g. expression) when rule.name is absent; omit empty Rule lines. Poutine injection findings: render injection_sources as formatted Sources instead of plain meta.details text. Changed PR comment layout: shared field helpers; non-dependency findings follow File → Rule → optional extras → description; single-scanner dependency findings use File instead of a redundant Source line. [0.3.0] - 2026-06-16 Added Cross-scanner deduplication by advisory id: findings that report the same CVE/GHSA for the same package from different scanners (e.g. OSV-Scanner from a lockfile and Trivy from a container layer) are now collapsed into a single finding. The contributing scanners are recorded in a new detected_by field (surfaced in the JSON report, the PR comment’s “Detected by” line, and a detectedBy SARIF result property). A CVE is preferred over GHSA so the same vulnerability converges on one id across scanners (#27). Richer dependency finding rendering: aggregated dependency findings now appear under a neutral [dependency] heading (instead of a single scanner’s name) with Package, Advisory (including the shared CVE), Detected by, and a Sources list showing where each scanner observed it. A new sources field on the finding (per-scanner tool + file) backs the JSON report (#27). Fixed PR comment rendering: scanner descriptions are flattened to a single line and their Markdown (code fences, headings) neutralized, so an unbalanced ``` fence can no longer swallow later findings and the footer into a code block. [0.2.0] - 2026-06-15 Supply-chain hardening for the scanner image and signed, verifiable releases (closes #30).