[Feature Request] Support multiple image tags

[gainings]

We are using docker buildx bake to generate multiple Docker images from a single Dockerfile. We want to perform a Sysdig scan on all the generated images.

However, the current implementation only accepts a single value for the image-tag parameter, requiring us to write the same step multiple times.

Therefore, we would like to request support for scanning multiple images by allowing the image-tags argument to accept multiple values.

[tembleking]

Are you doing that to build multiarchitecture images or are you using different arguments to generate differently built images?

If you are doing multiarchitecture, I would review one of the architectures, since most vulnerabilities are also shared between architectures.

If they are different images, I suggest using a matrix workflow, for example:

jobs:
  scan:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image:
          - myorg/api:${{ github.sha }}
          - myorg/web:${{ github.sha }}
          - nginx:alpine
          - redis:7.2

    steps:
      - name: Sysdig Secure Inline Scan
        uses: sysdiglabs/scan-action@v6
        with:
          image-tag: ${{ matrix.image }}
          stop-on-failed-policy-eval: true
          stop-on-processing-error: true
          sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}
          sysdig-secure-url:   ${{ env.SYSDIG_SECURE_URL }}