Scout CLI vs Scout Action with package types

[Tsingis]

Wondering if I'm doing something wrong or what causes the difference but let's take node:20-alpine image as example from here.

Outcome locally with my machine using CLI:

docker pull node:20-alpine
docker scout cves local://node:20-alpine --only-package-type npm

Outcome with GitHub action scout-action:

Run docker/scout-action@v1
  with:
    command: cves,recommendations
    image: local://node:20-alpine
    only-severities: critical,high
    only-package-types: npm
    only-fixed: true
    summary: true
    format: json
    exit-code: true
    github-token: ***
    write-comment: true

There's difference in number of packages. Locally CLI seems to actually filter with --only-package-type npm where as on Action only-package-types: npm just scans all packages (total of 217).

[felipecruz91]

Thank you for reporting this issue @Tsingis. We've identified the problem and we're working on a fix.