andersonshatch/Contrast Security Combined Scan
Composite action that runs both Contrast SCA and Local Scan actions
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Dec 9, 2025
- License
- None
Pinned Snippet
uses: andersonshatch/scan-and-sca@0111d9d4fdc115d15252e04843baed15b56dc3cb # no releases — HEAD as of 2026-07-13tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| apiUrl | URL of your Contrast instance | yes | https://app.contrastsecurity.com |
| apiKey | API Key from user settings (required for both actions) | yes | — |
| apiUserName | User name for authentication (required for both actions) | yes | — |
| apiServiceKey | Service Key from user settings (required for both actions) | yes | — |
| orgId | Organization ID from user settings (required for both actions) | yes | — |
| filePath | Specify the directory in which to search for project configuration files (required for SCA) | no | — |
| repositoryId | The ID of your repo (SCA) | no | — |
| projectGroupId | The ID of your project Groups (SCA) | no | — |
| applicationId | The ID of your application (SCA) | no | — |
| ignoreDev | When set to true, excludes developer dependencies from the results (SCA) | no | — |
| outputSummary | Defaults to true. When set to true, writes the output of the audit to the GitHub Actions Summary (SCA) | no | true |
| proxy | When set will pass the proxy url to the contrast cli (SCA) | no | — |
| repoUrl | When set, will pass the optional repo url parameter to the contrast cli (SCA) | no | — |
| repoName | When set, will pass the optional repo name parameter to the contrast cli (SCA) | no | — |
| externalId | When set, will pass the optional external id parameter to the contrast cli (SCA) | no | — |
| auditTimeout | Sets the timeout for an audit in seconds, Default: 600 (10 minutes) (SCA) | no | 600 |
| metadata | Metadata filter to be passed to the Contrast CLI when running sarif command (SCA) | no | — |
| ghasEnabled | When set to true, will upload sarif to the GHAS integration (SCA) | no | true |
| legacy | When set to true, uses the legacy audit command (SCA) | no | — |
| modifier | When set this will be added as a suffix to the output file name (SCA) | no | — |
| name | Contrast project name. If not specified, Contrast uses the file folder name to identify the project or creates a new project (SCA) | no | — |
| command | Command to run cli with audit/fingerprint/sarif (SCA) | no | audit |
| checks | If set, checks will be added to the current commit based on any vulnerabilities found. Requires the "checks: write" permission (Local Scan) | no | false |
| codeQuality | Set this to true to include code quality rules when executing source code scanner (Local Scan) | no | false |
| defaultBranch | Set this to true or false explicitly override the default branching behaviour in scan (Local Scan) | no | — |
| label | Label to associate with the current scan. Defaults to the current ref e.g. refs/heads/main (Local Scan) | no | — |
| memory | Memory setting passed to the underlying scan engine. Defaulted to 8g (Local Scan) | no | — |
| new | Set this to true or false to only fail the action on new vulnerabilities (Local Scan) | no | — |
| path | Path to scan with local scanner. Defaults to the current repository path (Local Scan) | no | — |
| projectName | Project to associate scan with. Defaults to current github repository name (Local Scan) | no | — |
| strategy | Used in conjunction with severity or checks, set this value to fail the build based on aggregated project vulnerabilities or scan level. Valid values are "project" or "scan". Defaults to "project" (Local Scan) | no | project |
| timeout | Execution timeout (in seconds) setting passed to the underlying scan engine. Defaulted to 60 minutes (Local Scan) | no | — |
| token | GitHub token for GitHub API requests. Defaults to GITHUB_TOKEN (Local Scan) | no | ${{ github.token }} |
| severity | Set this to cause the build to fail if vulnerabilities are found exceeding this severity or higher. Valid values are CRITICAL, HIGH, MEDIUM, LOW, NOTE | no | CRITICAL |
| fail | When set to true, fails the action if CVEs have been detected that match at least the severity option specified | no | — |
| resourceGroup | Resource group to assign newly created projects to | no | — |
| runSca | Set to true to run the SCA action | no | true |
| runLocalScan | Set to true to run the Local Scan action | no | true |
Outputs
| name | description |
|---|---|
| fingerprint | Output from the SCA fingerprint command |