anshumaan-10/Supply Chain Guardian
Enterprise-grade supply chain security scanner. 110+ attack patterns, 17 scanners, runtime monitoring, and binary analysis.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 28, 2026
- License
- None
Pinned Snippet
uses: anshumaan-10/supply-chain-guardian@4924e0e56e9fca443659520da55c149bec18c174 # v4.0.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | Action execution mode: scan — Full scan (default). Runs all scanners, reports, and optionally starts/stops the runtime monitor within this single step. monitor-start — Only start the runtime monitoring daemon. Use this BEFORE your build/test/deploy steps. The daemon runs in the background watching for threats. monitor-stop — Only stop the runtime monitor and collect findings. Use this AFTER your build steps but before the final scan. For split-mode runtime monitoring across multiple pipeline stages, call the action 3 times: 1. mode: monitor-start (before your pipeline) 2. (your build/test/deploy steps) 3. mode: scan + scan-runtime: true (collects daemon findings + runs all scanners) | no | scan |
| runtime-monitor | Enable continuous runtime monitoring daemon (only used in scan mode). Starts and stops the monitor automatically around the scan. | no | false |
| runtime-monitor-interval | Poll interval in seconds for the runtime monitor daemon (default: 5) | no | 5 |
| scan-mode | Scan mode: quick, standard, deep, paranoid | no | standard |
| fail-on-severity | Minimum severity to fail the pipeline: critical, high, medium, low, info | no | high |
| scan-workflows | Scan GitHub Actions workflow files for compromised actions, pwn requests, cache poisoning, OIDC abuse, artifact integrity, container supply chain, and reusable workflow trust issues | no | true |
| scan-dependencies | Scan package dependencies for known compromised packages and typosquatting | no | true |
| scan-secrets | Scan for secret exposure and credential exfiltration patterns | no | true |
| scan-network | Scan for network exfiltration, reverse shells, DNS tunneling, and C2 patterns | no | true |
| scan-permissions | Audit workflow permissions for least-privilege violations | no | true |
| scan-provenance | Verify dependency provenance and SLSA attestations | no | true |
| scan-runtime | Enable runtime monitoring for credential dumping during workflow execution | no | false |
| custom-rules-path | Path to custom YAML rules file for additional patterns | no | "" |
| exclude-paths | Comma-separated paths to exclude from scanning | no | "" |
| slack-webhook-url | Slack webhook URL for sending alerts | no | "" |
| teams-webhook-url | Microsoft Teams webhook URL for sending alerts | no | "" |
| alert-on-severity | Minimum severity to trigger Slack/Teams alerts: critical, high, medium | no | high |
| sarif-output | Generate SARIF report for GitHub Advanced Security | no | true |
| json-output | Path to write JSON report | no | supply-chain-guardian-report.json |
| table-output | Print detailed table output to workflow logs | no | true |
| github-token | GitHub token for API access (PR comments, issue creation) | no | ${{ github.token }} |
| block-pr | Block PR merge if critical findings are detected | no | true |
| create-issue | Create a GitHub issue on critical findings | no | true |
| auto-comment-pr | Automatically comment on PRs with scan results | no | true |
| exceptions-config | Path to a custom SCG exceptions/exemption config file (YAML). If not set, the scanner looks for .scg-config.yml in the repo root. Use this for org-wide central exception policies. Format: YAML with keys: exemptions, egress_allowlist, disabled_scanners, severity_overrides. | no | "" |
| scan-binaries | Enable binary analysis scanner to detect suspicious executables in the workspace. Auto-enabled in deep/paranoid modes. | no | false |
| html-output | Generate a self-contained HTML report viewable directly in the browser. Produced alongside JSON/SARIF. | no | false |
| html-output-path | Filename for the HTML report (default: supply-chain-guardian-report.html) | no | supply-chain-guardian-report.html |
| artifact-name | Custom name for the auto-uploaded artifact. Override to avoid 409 conflicts when calling SCG multiple times in the same workflow. | no | supply-chain-guardian-report |
| skip-artifact-upload | Skip automatic artifact upload (set true if you handle artifacts manually) | no | false |
| extra-scan-paths | Comma-separated list of additional directories to scan for workflow files, package manifests, Dockerfiles, and CI configs. Paths are relative to the workspace root. | no | "" |
| verbose | Enable verbose/debug output | no | false |
Outputs
| name | description |
|---|---|
| scan-status | Overall scan result: PASSED, WARNING, FAILED |
| total-findings | Total number of findings |
| critical-findings | Number of critical findings |
| high-findings | Number of high severity findings |
| medium-findings | Number of medium severity findings |
| low-findings | Number of low severity findings |
| report-path | Path to the JSON report file |
| sarif-path | Path to the SARIF report file |
| exempted-findings | Number of findings that were exempted by .scg-config.yml rules |