Seeing a weird issue with Grype not respecting "With" stanza...

[RLI-Rdeaton]

This could be me being entirely new to github actions, however consider the following action:

  grype:
    needs: build
    runs-on: ubuntu-latest
    steps:
      -
        name: Scan image
        uses: anchore/[email protected]
        id: grypescan
        with:
          registry-username: ${{ vars.DOCKERHUB_USERNAME }}
          registry-password: ${{ secrets.DOCKERHUB_TOKEN }}
          image: ${{ env.IMAGE_NAME }}
          fail-build: false
      -
        name: upload Anchore scan SARIF report
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: ${{ steps.grypescan.outputs.sarif }}

This action runs, however it does not appear to respect the fact that I have set fail-build to false. It doesn't seem to respect anything. I feel like I'm doing something way wrong. Here's the output:

Warning: Unexpected input(s) 'registry-username', 'registry-password', valid inputs are ['image', 'path', 'sbom', 'fail-build', 'output-format', 'severity-cutoff', 'only-fixed', 'add-cpes-if-none', 'by-cve', 'grype-version', 'vex']
Run anchore/[email protected]
  with:
    registry-username: modusmundi
    registry-password: ***
    image: modusmundi/testingscap:latest
    fail-build: false
    output-format: sarif
    severity-cutoff: medium
    only-fixed: false
    add-cpes-if-none: false
    by-cve: false
  env:
    REGISTRY: docker.io
    IMAGE_NAME: modusmundi/testingscap:latest
/usr/bin/sh /home/runner/work/_temp/30bc3b5b-920a-4713-8c7c-7286ced65a11 -d -b /home/runner/work/_temp/30bc3b5b-920a-4713-8c7c-7286ced65a11_grype v0.80.0
[info] checking github for release tag='v0.80.0' 
[debug] http_download(url=https://github.com/anchore/grype/releases/v0.80.0) 
[info] fetching release script for tag='v0.80.0' 
[debug] http_download(url=https://raw.githubusercontent.com/anchore/grype/v0.80.0/install.sh) 
[info] checking github for release tag='v0.80.0' 
[debug] http_download(url=https://github.com/anchore/grype/releases/v0.80.0) 
[info] using release tag='v0.80.0' version='0.80.0' os='linux' arch='amd64' 
[debug] downloading files into /tmp/tmp.8dFny5tNmB 
[debug] http_download(url=https://github.com/anchore/grype/releases/download/v0.80.0/grype_0.80.0_checksums.txt) 
[debug] http_download(url=https://github.com/anchore/grype/releases/download/v0.80.0/grype_0.80.0_linux_amd64.tar.gz) 
[info] installed /home/runner/work/_temp/30bc3b5b-920a-4713-8c7c-7286ced65a11_grype/grype 
grype output...
  Executing: grype -o sarif --fail-on medium modusmundi/testingscap:latest
  discovered vulnerabilities at or above the severity threshold

What I'm trying to achieve here is to get a current enumeration of issues in the build, not stop the build outright. I might want to do that in the future, but for now this is a POC and me trying to learn how these items work. Right now it honestly feels like it would be less frustrating to just download grype into a runner, execute grype with the options I want, and get the output that way.

Some help understanding what is going on here would be tremendous. Thanks in advance.

[RLI-Rdeaton]

Wrong place.