aboutcode-org/ScanCode action
Run ScanCode.io pipelines in your workflows
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 2, 2026
- License
- Apache 2.0
Pinned Snippet
uses: aboutcode-org/scancode-action@76777db8400d719de67ba3e465c5881037b45cb9 # v0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| pipelines | Names of the pipelines (comma-separated) and in order. | — | scan_codebase |
| output-formats | Output formats | — | json xlsx spdx cyclonedx |
| inputs-path | Relative path within the $GITHUB_WORKSPACE for pipeline inputs | — | scancode-inputs |
| input-urls | Provide one or more URLs to download for the pipeline run execution. | no | "" |
| project-name | Name of the project. | — | scancode-action |
| outputs-archive-name | Name of the outputs archive. | — | scancode-outputs |
| check-compliance | Check for compliance issues in the project. Exits with a non-zero status if compliance issues are detected. | no | false |
| compliance-fail-level | Failure level for compliance check. Options: ERROR, WARNING, MISSING. | no | ERROR |
| compliance-fail-on-vulnerabilities | Exit with a non-zero status if known vulnerabilities are detected in discovered packages and dependencies. | no | false |
| scancodeio-image | ScanCode.io Docker image to use. | — | ghcr.io/aboutcode-org/scancode.io@sha256:6fc8023bc588602ef2ec2b699c2503d8771fe5ef16470475fe64b641f0955f5b |
Outputs
no outputs