Aikido Scan
CertifiedScan an Aikido container repository
Aikido Scan
Scan an Aikido container repository
Triggers a rescan of a container image. The API call itself is fire-and-forget (no scan id); set waitForCompletion to poll the container's last_scanned_at timestamp until the scan finishes.
type: io.kestra.plugin.aikido.containers.ScanExamples
Rescan a container image after a new build
id: aikido_scan_container
namespace: company.security
inputs:
- id: container_id
type: STRING
tasks:
- id: scan
type: io.kestra.plugin.aikido.containers.Scan
clientId: "{{ secret('AIKIDO_CLIENT_ID') }}"
clientSecret: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
containerId: "{{ inputs.container_id }}"
waitForCompletion: true
Properties
clientId *string
OAuth2 client ID
Client ID of an Aikido API client with the OAuth2 scopes required by the tasks and triggers being used (for example issues: read, repositories: write). Client credentials are created in the Aikido console under Settings > API access.
clientSecret *string
OAuth2 client secret
Client secret of the Aikido API client. Exchanged for a short-lived JWT Bearer token on first use (and transparently refreshed before it expires); never logged or included in error messages.
containerId *string
Container repository ID
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150baseUrl string
https://app.aikido.devAikido API base URL
Base URL of the Aikido Security application for your account's region: https://app.aikido.dev (Europe, default), https://app.us.aikido.dev (United States), https://app.au.aikido.dev (Australia), or https://app.me.aikido.dev (Middle East). The OAuth2 token endpoint is derived from this same host, so a region override applies to both authentication and API calls.
maxDuration string
PT1HMaximum wait duration
Maximum time to wait for the scan to complete before failing. Only used when waitForCompletion is true. Defaults to PT1H.
pollInterval string
PT10SPoll interval
How often to re-check last_scanned_at while waiting for completion. Only used when waitForCompletion is true. Defaults to PT10S.
waitForCompletion booleanstring
falseWait for scan completion
When true, polls the resource's last_scanned_at timestamp after triggering the scan until it advances past its pre-scan value, then returns. Caveat: Aikido's scan-trigger endpoints are fire-and-forget with no scan id and no status endpoint, so this observes "a scan finished" on the resource, not necessarily "the scan this task started finished" — a concurrent scan on the same resource can also satisfy it. The wait blocks a worker thread for its whole duration (up to maxDuration), so budget worker slots accordingly when running many scans concurrently with this enabled. Defaults to false, so the task returns immediately after triggering.
Outputs
completed boolean
Whether the task waited for and observed scan completion
Always false when waitForCompletion is false.
triggered boolean
Whether the scan was successfully triggered
