42crunch/42Crunch REST API Static Security Testing
The REST API Static Security Testing action adds an automatic static application security testing (SAST) to your workflows
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Feb 18, 2026
- License
- Apache 2.0
Pinned Snippet
uses: 42crunch/api-security-audit-action@c675c3d41a7932c89d166717572e5c243afaa54d # v4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| api-token | The API token to access 42Crunch Platform. Follow hese steps to configure API_TOKEN https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm | no | — |
| min-score | Minimum score for OpenAPI files. | no | 75 |
| platform-url | 42Crunch platform URL | no | https://us.42crunch.cloud |
| log-level | Log level, one of: FATAL, ERROR, WARN, INFO, DEBUG | no | INFO |
| share-everyone | Share new API collections with everyone, one of: OFF, READ_ONLY, READ_WRITE | no | OFF |
| github-token | GitHub token for uploading results to Github Code Scanning | no | ${{ github.token }} |
| upload-to-code-scanning | Upload results to Github Code Scanning | no | false |
| ignore-failures | If set to 'true', disables all local failure conditions (like minimum score) and fails execution only if the criteria defined in SQGs are not met. | no | false |
| root-directory | Set the root directory for the plugin | no | — |
| default-collection-name | Change the default collection name | no | — |
| json-report | Writes Audit report in JSON format to a specified file | no | — |
| api-tags | List of tags to be set on the newly created APIs. Format "category1:name1 category2:name2", optional. | no | — |
| ignore-network-errors | If set to 'true', forces to complete execution successfully even if a network error has occurred (such as a failure to connect to 4unch Platform, etc). | no | false |
| skip-local-checks | If set to 'true', forces to complete execution successfully even if the failures conditions (like min-score or SQG criteria) you have set are met. | no | false |
| sarif-report | Writes SARIF report to a specified file | no | "" |
| audit-timeout | Set the maximum timeout (in seconds) for the audit report. Fail if the result isn't ready within that interval. | no | — |
Outputs
no outputs