accionqa/Veracode Static Analysis Pipeline Scan and SARIF import

Initiate a Veracode Static Analysis Pipeline Scan and convert the results file to a valid SARIF file

Trust Signals

workflow.ymlSHA-pinned

uses: accionqa/veracode-pipleine-scan-results-to-sariff@1523a567f6cb587d278e0ced4adba633c87edd72 # no releases — HEAD as of 2026-07-13

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
scan-type	The scan type for which a SARIF report needs to be generated can be either a pipeline scan or a policy scan	yes	pipeline
results-json	The location of the JSON result file for the policy or pipeline	yes	filtered_results.json
pipeline-results-json	location of the pipeline json result file	yes	results.json
output-results-sarif	the path to the SARIF file as an output of the transformation	yes	veracode-results.sarif
source-base-path-1	a path prefix conversion before publish in the SARIF file	no	""
source-base-path-2	a path prefix conversion before publish in the SARIF file	no	""
source-base-path-3	a path prefix conversion before publish in the SARIF file	no	""
finding-rule-level	The conversion rule of Veracode findings to GitHub level	yes	4:3:0
repo_owner	The account owner of the repository. The name is not case sensitive.	no	—
repo_name	The name of the repository without the .git extension. The name is not case sensitive.	no	—
githubToken	GitHub token is a secure token that allows the workflow to interact with the GitHub API and perform actions on behalf of the repository or user	yes	${{ github.token }}
ref	The full Git reference	yes	${{ github.ref }}
commitSHA	The SHA of the commit to which the analysis you are uploading relates.	yes	${{ github.sha }}
noupload	Do not upload the SARIF file to the GitHub repository	no	false

no outputs