blackduck-inc/Black Duck Security Scan
Find and fix software weaknesses and vulnerabilities during development, before you ship or deploy!
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- Apache 2.0
Pinned Snippet
uses: blackduck-inc/black-duck-security-scan@3fe94e4b3c3947bd21ba46b7da255d6d3638b325 # v2.10.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| coverity_url | Coverity url | no | — |
| coverity_user | Coverity user name | no | — |
| coverity_password | Coverity password | no | — |
| coverity_passphrase | Coverity password (deprecated, use coverity_password instead) | no | — |
| coverity_project_name | Coverity Project Name | no | — |
| coverity_stream_name | Coverity Stream Name | no | — |
| coverity_install_directory | Coverity Install Directory | no | — |
| coverity_policy_view | Coverity Policy View | no | — |
| coverity_local | Flag to enable/disable to run coverity scan locally. | no | — |
| coverity_version | If provided, Black Duck Security Action will download specific version of coverity thin client to use. | no | — |
| coverity_prComment_enabled | Flag to enable pull request comments for new issues found in the Coverity scan | no | — |
| coverity_prComment_impacts | List of impacts for which the Coverity PR Comments should be created. Supported values: HIGH, MEDIUM, LOW, AUDIT | no | — |
| coverity_waitForScan | Specifies if the workflow should wait for the analysis to complete. Default value: true. If set to false, post merge workflows like PR comment, Fix PR, SARIF etc will not be applicable. | no | — |
| coverity_build_command | Build command for Coverity | no | — |
| coverity_clean_command | Clean command for Coverity | no | — |
| coverity_config_path | Coverity config file path (.yaml/.yml/.json) | no | — |
| coverity_args | Additional Coverity Arguments separated by space | no | — |
| bridge_coverity_version | If provided, Black Duck Security Action will download specific version of coverity thin client to use. | no | — |
| polaris_access_token | Polaris Access Token | no | — |
| polaris_application_name | Polaris Application Name | no | — |
| polaris_project_name | Polaris Project Name | no | — |
| polaris_assessment_types | Polaris Assess Types SAST/SCA | no | — |
| polaris_server_url | Polaris Server URL | no | — |
| polaris_prComment_enabled | Flag to enable pull request comments based on Polaris scan result | no | — |
| polaris_prComment_severities | List of severities for which the PR Comments should be created | no | — |
| polaris_triage | Polaris Triage | no | — |
| polaris_branch_name | Polaris branch name | no | — |
| polaris_branch_parent_name | Polaris parent branch name | no | — |
| polaris_test_sca_type | Polaris SCA test type (SCA-SIGNATURE, SCA-PACKAGE, SCA-BINARY) | no | — |
| polaris_artifactToUpload | Path to a binary/archive/container file to analyze. This is required when using SCA-BINARY or SCA-CONTAINER as the SCA Test Type. | no | — |
| polaris_container_name | Container name for Polaris SCA Container scan. Required when polaris_test_sca_type is set to SCA-CONTAINER. | no | — |
| polaris_test_sast_type | Polaris test type to trigger sigma rapid scan or full scan | no | — |
| polaris_test_sca_location | Polaris SCA test location | no | — |
| polaris_test_sast_location | Polaris SAST test location | no | — |
| polaris_reports_sarif_create | Flag to enable/disable Polaris SARIF report generation | no | — |
| polaris_reports_sarif_file_path | File path including file name where Polaris SARIF report should be created | no | — |
| polaris_reports_sarif_severities | Indicates what SAST/SCA issues severity categories to include in Polaris SARIF file report | no | — |
| polaris_reports_sarif_groupSCAIssues | Flag to enable/disable Component-Version grouping for SCA Issues in Polaris SARIF report rules section | no | — |
| polaris_reports_sarif_issue_types | Enum to indicate which assessment issues type to include in Polaris SARIF file report | no | — |
| polaris_upload_sarif_report | Flag to enable/disable uploading of Polaris SARIF report to GitHub Advanced Security | no | — |
| polaris_waitForScan | Specifies if the workflow should wait for the analysis to complete. Default value: true. If set to false, post merge workflows like PR comment, Fix PR, SARIF etc will not be applicable. | no | — |
| polaris_assessment_mode | The test mode type of this scan | no | — |
| polaris_externalIssues_create | Polaris External Issues Create | no | — |
| polaris_externalIssues_types | Polaris External Issues Types | no | — |
| polaris_externalIssues_severities | Polaris External Issues severities | no | — |
| polaris_externalIssues_groupSCAIssues | Polaris External Issues groupSCAIssues | no | — |
| polaris_externalIssues_maxCount | Polaris External Issues maxCount | no | — |
| project_directory | The project source directory. Defaults to repository root directory. Set this to specify a custom folder that is other than repository root | no | — |
| project_source_archive | The zipped source file path. It overrides the project directory setting | no | — |
| project_source_preserveSymLinks | Flag indicating whether to preserve symlinks in the source zip | no | — |
| project_source_excludes | A list of git ignore pattern strings that indicate the files need to be excluded from the zip file | no | — |
| bridgecli_install_directory | Bridge CLI Install Directory | no | — |
| bridgecli_download_url | URL to download bridge from | no | — |
| blackducksca_url | URL for blackduck hub | no | — |
| blackducksca_token | API token to access blackduck | no | — |
| detect_install_directory | Directory to find or install detect | no | — |
| blackducksca_scan_full | Scan Mode. (true for intelligent scan & false for rapid scan) | no | — |
| blackducksca_scan_failure_severities | If provided, Black Duck will break the build if any issues produced match one of the given severities | no | — |
| blackducksca_fixpr_enabled | If set as true, separate Fix PRs will be created if vulnerability is found after scan | no | — |
| blackducksca_fixpr_maxCount | Maximum number of Pull Requests to be created that violate policies | no | — |
| blackducksca_fixpr_filter_severities | If provided, Fix PRs will be created only for given severities | no | — |
| blackducksca_fixpr_useUpgradeGuidance | Flag to enable long term upgrade guidance | no | — |
| bridgecli_download_version | If provided, Black Duck Security Action will configure the version of Bridge | no | — |
| blackducksca_prComment_enabled | Flag to enable pull request comments for new issues found in the Black Duck scan | no | — |
| blackducksca_reports_sarif_create | Flag to enable/disable Black Duck SARIF report generation | no | — |
| blackducksca_reports_sarif_file_path | File path including file name where Black Duck SARIF report should be created | no | — |
| blackducksca_reports_sarif_severities | Indicates what SAST/SCA issues severity categories to include in Black Duck SARIF file report | no | — |
| blackducksca_reports_sarif_groupSCAIssues | Flag to enable/disable Component-Version grouping for SCA Issues in Black Duck SARIF report rules section | no | — |
| blackducksca_upload_sarif_report | Flag to enable/disable uploading of Black Duck SARIF report to GitHub Advanced Security | no | — |
| blackducksca_waitForScan | Specifies if the workflow should wait for the analysis to complete. Default value: true. If set to false, post merge workflows like PR comment, Fix PR, SARIF etc will not be applicable. | no | — |
| detect_search_depth | Number indicating the search depth in the source directory | no | — |
| detect_args | Additional Black Duck Arguments separated by space | no | — |
| detect_config_path | Black Duck config file path (.properties/.yml) | no | — |
| blackducksca_policy_badges_create | To enable creation of badges on the GitHub repository | no | — |
| blackducksca_policy_badges_maxCount | To limit number of badges to be displayed on the GitHub repository | no | — |
| blackducksca_externalIssues_create | Black Duck SCA External Issues Create | no | — |
| blackducksca_externalIssues_severities | Black Duck SCA External Issues severities | no | — |
| blackducksca_externalIssues_groupSCAIssues | Black Duck SCA External Issues groupSCAIssues | no | — |
| blackducksca_externalIssues_maxCount | Black Duck SCA External Issues maxCount | no | — |
| srm_url | SRM Url | no | — |
| srm_apikey | SRM Api Key | no | — |
| srm_assessment_types | SRM Assessment Types | no | — |
| srm_project_name | SRM project name | no | — |
| srm_branch_name | SRM branch name | no | — |
| srm_project_id | SRM branch Id | no | — |
| srm_branch_parent | SRM branch parent | no | — |
| srm_waitForScan | Specifies if the workflow should wait for the analysis to complete. Default value: true. If set to false, post merge workflows like PR comment, Fix PR, SARIF etc will not be applicable. | no | — |
| coverity_execution_path | Coverity execution path | no | — |
| detect_execution_path | Black Duck execution path | no | — |
| github_token | Github token to be used for git related rest operation | no | — |
| include_diagnostics | To include diagnostics info and export as zip | no | — |
| diagnostics_retention_days | Number of days to keep the diagnostics files downloadable | no | — |
| bridge_network_airgap | If provided, Black Duck Security Action will be using local network to download and execute bridge . | no | — |
| network_airgap | If provided, Black Duck Security Action will be using local network to download and execute bridge . | no | — |
| polaris_policy_badges_create | To enable creation of badges on the GitHub repository for polaris | no | — |
| polaris_policy_badges_maxCount | To limit number of badges to be displayed on the GitHub repository for polaris | no | — |
| polaris_fixpr_enabled | Enable automatic fix pull request creation for Polaris SCA vulnerabilities | no | — |
| polaris_fixpr_maxCount | Maximum number of fix PRs to create on a branch. Default: 5 | no | — |
| polaris_fixpr_useUpgradeGuidance | Upgrade guidance preference. Values: SHORT_TERM, LONG_TERM, or SHORT_TERM,LONG_TERM. Default: SHORT_TERM,LONG_TERM | no | — |
| polaris_fixpr_filter_severities | Comma-separated list of severities (CRITICAL, HIGH, MEDIUM, LOW). Default: CRITICAL,HIGH | no | — |
| mark_build_status | Specify the build status if policy violating issues are found. | no | failure |
| network_ssl_cert_file | File path to configure the HttpClient to accept a self-signed certificate. | no | — |
| network_ssl_trustAll | Boolean value to trust all certificates. | no | — |
Outputs
| name | description |
|---|---|
| status | The numeric exit code returned by the Black Duck Security Scan. |