armissecurity/Armis Security Scanner
Enterprise-grade security scanning for repositories and container images with Armis Cloud
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- None
Pinned Snippet
uses: armissecurity/armis-cli@87b5bd65522b4c94e48c6941c64efb9269c24d53 # v1.18.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-type | Type of scan to perform: repo or image | yes | — |
| scan-target | Target to scan (path for repo, image name for image scan) | no | . |
| client-id | Client ID for JWT authentication (recommended) | no | — |
| client-secret | Client secret for JWT authentication (recommended) | no | — |
| region | Armis cloud region for JWT authentication | no | "" |
| api-token | Armis API token for Basic authentication (legacy) | no | — |
| tenant-id | Tenant identifier for Armis Cloud (legacy, not needed with JWT) | no | — |
| format | Output format: human, json, sarif, junit | no | sarif |
| fail-on | Comma-separated severity levels to fail on (e.g., HIGH,CRITICAL). Empty string for informational mode (never fail). | no | "" |
| exit-code | Exit code to return when build fails | no | 1 |
| no-progress | Disable progress indicators | no | true |
| image-tarball | Path to image tarball (only for image scans) | no | — |
| output-file | File path to write scan results (optional) | no | — |
| scan-timeout | Scan timeout in minutes | no | 60 |
| include-files | Comma-separated list of file paths to scan (relative to repository root) | no | "" |
| build-from-source | Build CLI from source instead of downloading release (for testing) | no | false |
Outputs
| name | description |
|---|---|
| results | Scan results in the specified format |
| exit-code | Exit code from the scan |