Dockle scan fails due to invalid username/password combo

Trivy check runs successfully according to log

Scanning for vulnerabilities...
No vulnerabilities were detected in the container image

But after Dockle initializes we get this message:

Scanning for CIS and best practice violations...
Error: FATAL	unable to initialize a image struct: failed to initialize source: unable to retrieve auth token: invalid username/password: unauthorized: authentication required, visit https://aka.ms/acr/authorization for more information.
Error: An error occurred while scanning the container image for best practice violations

The action seems to be taking the credentials we provided

Run Azure/container-scan@v0
  with:
    image-name: ***/search-training-index:aa12c0d5170e523d92ddf29cfc51e54a7a7c19ea
    username: ***
    password: ***
    severity-threshold: HIGH
    token: ***
    run-quality-checks: true
  env:
    AZURE_WEBAPP_NAME: search-training-index

We know our credentials are right, because are being used by other actions.

Any idea of what’s going on? What i’m missing?

[tomoyamachi]

@JeffreyArt1 Thank you for the report. That was a Dockle’s bug and I fixed it. For details, see this issue.

[shigupt202]

As a workaround, you can pull the ACR image before running the container-scan action.