abhishekamralkar/Argus Vulnerability Scanner
RAG-powered local vulnerability scanner for Go, Python, Rust, npm, Maven, NuGet, and Ruby — runs entirely on the GitHub Actions runner, no cloud required.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 19, 2026
- License
- None
Pinned Snippet
uses: abhishekamralkar/argus@89f32f36e66243326698539eda1805ae67c69139 # v1.0.24tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Argus version to use (e.g. v1.0.17). Defaults to latest release. | no | latest |
| scan-path | Directory containing the project to scan. | no | . |
| db-path | Path to the DuckDB vulnerability database file. | no | /tmp/argus-vulns.db |
| ecosystems | Comma-separated ecosystems to ingest before scanning (go, python, rust, npm, maven, nuget). Leave empty to skip ingest and use a pre-cached db. | no | "" |
| output-format | Output format: text, json, sarif, cyclonedx, or spdx. | no | sarif |
| fail-on | Severity or CVSS threshold that causes a non-zero exit: LOW, MEDIUM, HIGH, CRITICAL, or cvss:N.N. | no | HIGH |
| min-severity | Minimum severity to report: LOW, MEDIUM, HIGH, CRITICAL. | no | "" |
| min-cvss | Minimum CVSS v3 base score to report (0 = report all). | no | "" |
| profile | Named scan profile: default, fast, ci, or thorough. Overrides workers/top-k/similarity defaults. | no | "" |
| baseline-mode | Baseline mode: full (all findings), diff (new only), update (diff + save baseline). | no | full |
| fixes-only | Only report packages that have at least one finding with a known fix version. | no | false |
| upload-sarif | Upload SARIF results to the GitHub Security tab (requires output-format: sarif). | no | true |
| ollama-host | Ollama server URL. Ignored when OPENAI_API_KEY is set. | no | http://localhost:11434 |
| llm-model | LLM model name (Ollama default: llama3.1:8b; OpenAI default: gpt-4o-mini). | no | "" |
| embed-model | Embedding model name (Ollama default: nomic-embed-text; OpenAI default: text-embedding-3-small). | no | "" |
| workers | Number of parallel dependency analysis workers. | no | "" |
| top-k | Number of vector search candidates per dependency. | no | "" |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF file (when output-format is sarif). |
| findings-count | Total number of findings reported by the scan. |