actions-marketplace-validations/AI SSDLC Security Suite
AI-powered Secure SDLC scanning — SAST, IaC, secrets, SCA, containers & threat modeling in a single action
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 8, 2026
- License
- None
Pinned Snippet
uses: actions-marketplace-validations/subzone_ssdlc-action@0ea21b774edaa892687f0d0f6c35f46c957ba2c1 # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| ai-api-key | API key for the AI provider — Anthropic or OpenAI key. Not required when ai-provider is github; use github-token instead. | no | "" |
| ai-provider | AI provider: anthropic | openai | github (GitHub Models — free, no external account needed) | no | anthropic |
| ai-model | Model to use. Anthropic: claude-sonnet-4-6. OpenAI: gpt-4o. GitHub Models: gpt-4o-mini | no | claude-sonnet-4-6 |
| github-token | GitHub token for SARIF upload, PR comments, and GitHub Models AI (ai-provider: github). Always pass secrets.GITHUB_TOKEN. | no | "" |
| license-key | Signed SSDL1 license token for Pro/Enterprise features (optional — free tier if omitted) | no | "" |
| enable-sast | Run SAST scanning with Semgrep | no | true |
| enable-secret-scan | Run secret scanning with Gitleaks | no | true |
| enable-sca | Run Software Composition Analysis (dependency vulnerabilities) | no | true |
| enable-iac-scan | Run IaC security scan with Checkov (Terraform, CloudFormation, Bicep) | no | true |
| enable-container-scan | Run container image scan with Trivy | no | false |
| container-image | Container image to scan (required if enable-container-scan is true) | no | "" |
| trivy-ignore-unfixed | For the container image scan path (trivy image) only: skip CVEs that have no fix available in the OS package manager to reduce noise from won't-fix entries in base images. Does not affect Trivy filesystem/SCA scans (trivy fs). | no | false |
| enable-threat-modeling | Run AI-powered STRIDE threat modeling on architecture changes | no | false |
| enable-ai-triage | Use AI to triage, deduplicate and prioritise findings | no | true |
| enable-ai-fix-suggestions | Include AI-generated fix suggestions in the PR comment | no | true |
| severity-threshold | Minimum severity that fails the build: critical | high | medium | low | no | high |
| fail-on-findings | Set to false to report findings without blocking the workflow | no | true |
| post-pr-comment | Post AI security summary as a PR comment | no | true |
| sarif-upload | Upload SARIF results to GitHub Security tab | no | true |
| cloud-provider | Primary cloud target for WAF control mapping: aws | azure | gcp | no | aws |
| ssdlc-api-url | Platform API base URL for DORA event reporting (e.g. https://api.ssdlc.io) | no | "" |
| ssdlc-api-key | API key for authenticating with the SSDLC platform API | no | "" |
| ssdlc-user-id | User ID (UUID) to associate DORA events with the correct account | no | "" |
| environment | Deployment environment name for DORA tracking (e.g. dev, staging, production) | no | production |
| semgrep-rules | Custom Semgrep ruleset (e.g. p/owasp-top-ten). Defaults to auto. | no | auto |
| checkov-framework | Checkov framework filter (e.g. terraform,cloudformation). Defaults to all. | no | "" |
| output-dir | Directory to write scan artefacts and reports into | no | .ssdlc-results |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings across all scanners |
| critical-count | Number of critical severity findings |
| high-count | Number of high severity findings |
| medium-count | Number of medium severity findings |
| low-count | Number of low severity findings |
| ai-summary | AI-generated plain-English security summary |
| threat-model | AI-generated STRIDE threat model (if enabled) |
| passed | true if the security gate passed, false if findings blocked the build |
| report-path | Path to the full JSON findings report |