blackoutsecure/Blackout Secure Code Scanning Kit

Run secret/code scanners and posture audits, then upload a unified SARIF log to GitHub Advanced Security.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 8, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: blackoutsecure/bos-code-scanning-kit@f0ec5bef0a90918e75b8ab59092c0234558737f4 # v1.0.5

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
owner	GitHub owner of the repo being scanned. Defaults to the workflow context.	no	""
repo	GitHub repo name being scanned. Defaults to the workflow context.	no	""
config	Path to `.bos-scan.yml`. Defaults to auto-discovery at the repo root.	no	""
github_token	Token used by the posture audit (PS001 code scanning, PS002 secret scanning, PS003 Dependabot alerts, PS020-PS025 branch protection). Leave empty to fall back to the workflow's built-in GITHUB_TOKEN, which is enough for PS001 only. PS002/PS003/PS020-PS025 require a PAT with admin reach — by org convention stored as a secret named `SCANNING_PAT`. See the kit README § 'SCANNING_PAT — advanced posture credentials' for the classic / fine-grained tick checklist and the recommended caller pattern.	no	""
enable_posture	`true` to run the posture audit step.	no	true
enable_scanners	`true` to run the bundled scanners (actionlint / gitleaks / shellcheck).	no	true
enable_upload	`true` to upload the merged SARIF to GitHub Advanced Security.	no	true
fail_on	`fail` (default) — exit non-zero if posture has any FAIL findings or any scanner reports a result. `never` — collect findings but always exit 0 (useful for first-time rollouts).	no	fail
http_timeout	Per-request HTTP timeout (seconds) for the posture audit's GitHub REST calls. Default `20`. Each probe is independent, so the practical upper bound on a posture run is roughly `http_timeout` * number-of-probes (~10 on a baseline scan). Bump on self-hosted runners with slow egress, or to ride out brief GitHub API latency spikes that otherwise surface as `PS*** error: HTTP 502` rows. Bare integer string; no unit.	no	20
sarif_output	Path for the merged SARIF artefact.	no	bos-scan.sarif

Outputs

name	description
sarif_path	Path to the merged SARIF file produced by the run.
posture_failures	Number of FAIL findings from the posture audit.
outcome	Severity-tier verdict for the run: `success` (no findings at any level), `warn` (only warning/note-level findings — nothing the enforcement policy would block on), or `failure` (at least one error-level finding from the posture audit or any scanner). Reflects severity only — it does NOT change based on `fail_on`, so callers can gate pipelines on the verdict independently of whether the kit step itself exited non-zero.