argus-codesecurity/Argus Security Scan
AI-enriched application security scanning: hardcoded secrets, vulnerable dependencies (live OSV data, transitive via lockfiles), SAST, taint analysis, and IaC misconfigurations, with explanations, SARIF upload to GitHub Code Scanning, and diff-aware pull-request gating. Offline by default: no API key needed and code never leaves the runner.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan, relative to the workspace. | no | . |
| fail-on | Fail the step if any finding is at/above this severity (critical | high | medium | low). Empty = never fail the build. | no | "" |
| scanners | Comma-separated scanners to run (default: all). See `argus scanners`. | no | "" |
| exclude-scanners | Comma-separated scanners to skip. | no | "" |
| min-severity | Only report findings at/above this severity. | no | "" |
| config | Path to an .argus.yml config file. | no | "" |
| sarif-file | Where to write the SARIF report. | no | argus.sarif |
| upload-sarif | Upload the SARIF report to GitHub Code Scanning (needs `security-events: write` permission). Set to "false" to skip. | no | true |
| category | Code Scanning category for the SARIF upload. | no | argus |
| diff-aware | On pull requests, scan the base branch first and report only findings the PR introduces. Requires a checkout with enough history (fetch-depth: 0). | no | true |
| pr-comment | On pull requests, post the findings the PR introduces as an inline review (the "PR bot"). Needs `pull-requests: write` permission. Off by default. | no | false |
| argus-version | argus-appsec version to install (default: latest from PyPI). | no | "" |
| python-version | Python version used to run Argus. | no | 3.12 |
| extra-args | Extra arguments appended verbatim to `argus scan`. | no | "" |
Outputs
| name | description |
|---|---|
| sarif-file | Path of the SARIF report that was produced. |