actions-marketplace-validations/Contrast Security SCA
Contrast Source Composition Analysis
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Feb 26, 2026
- License
- Apache 2.0
Pinned Snippet
uses: actions-marketplace-validations/contrast-security-oss_contrast-sca-action@c953b1def9b16036e6aa1775daf9030f40f80de6 # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| apiKey | An agent API key provided by Contrast (required). | yes | — |
| authHeader | User authorization credentials provided by Contrast (required). | yes | — |
| orgId | The ID of your organization in Contrast (required). | yes | — |
| filePath | Specify the directory in which to search for project configuration files (required). | yes | — |
| repositoryId | The ID of your repo. | no | — |
| projectGroupId | The ID of your project Groups. | no | — |
| applicationId | The ID of your application. | no | — |
| apiUrl | The name of the host. Includes the protocol section of the URL (https://). Defaults to https://ce.contrastsecurity.com. (optional) | no | https://ce.contrastsecurity.com |
| severity | Allows user to report libraries with vulnerabilities above a chosen severity level. Values for level are high, medium or low. (Note: Use this input in combination with the fail input, otherwise the action will exit) | no | CRITICAL |
| fail | When set to true, fails the action if CVEs have been detected that match at least the severity option specified. | no | — |
| ignoreDev | When set to true, excludes developer dependencies from the results. | no | — |
| outputSummary | Defaults to true. When set to true, writes the output of the audit to the GitHub Actions Summary. | no | true |
| proxy | When set will pass the proxy url to the contrast cli | no | — |
| repoUrl | When set, will pass the optional repo url parameter to the contrast cli | no | — |
| repoName | When set, will pass the optional repo name parameter to the contrast cli | no | — |
| externalId | When set, will pass the optional external id parameter to the contrast cli | no | — |
| auditTimeout | Sets the timeout for an audit in seconds, Default: 600 (10 minutes) | no | 600 |
| metadata | Metadata filter to be passed to the Contrast CLI when running sarif command | no | — |
| sarifToolType | Tool type to include in the sarif file. One of SCA or ASSESS. If not specified, both will be included. | no | — |
| ghasEnabled | When set to true, will upload sarif to the GHAS integration | no | true |
| legacy | When set to true, uses the legacy audit command. | no | — |
| modifier | When set this will be added as a suffix to the output file name. | no | — |
| name | Contrast project name. If not specified, Contrast uses the file folder name to identify the project or creates a new project | no | — |
| resourceGroup | Resource group to assign newly created projects to | no | — |
| command | Command to run cli with audit/fingerprint/sarif | no | audit |
Outputs
| name | description |
|---|---|
| fingerprint | Output from the fingerprint command |