bridgecrewio/Bridgecrew Github Action
Find and fix security and compliance issues in infrastructure as code, open source packages, container images, and CI/CD configurations using Bridgecrew Action
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Mar 18, 2025
- License
- MIT
Pinned Snippet
uses: bridgecrewio/bridgecrew-action@e388196ade022d4c6f28c368c4428b05e4f5d33a # v1.177.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| file | File with infrastructure code or packages to scan | no | — |
| directory | directory with infrastructure code to scan | no | . |
| check | Run scan only on a specific check identifier (comma separated) | no | — |
| skip_check | Run scan on all checks but a specific check identifier (comma separated) | no | — |
| compact | Do not display code blocks in output | no | — |
| quiet | display only failed checks | no | — |
| api-key | Environment variable name of the Bridgecrew API key from Bridgecrew app | no | — |
| use_enforcement_rules | Use the Enforcement rules configured in the platform for hard / soft fail logic. See checkov help text for more details on the nuances of this option. | no | — |
| skip_results_upload | Do not upload scan results to the platform to view in the console. Results are only available locally. If you use the --support flag, logs will still get uploaded. | no | — |
| enable_secrets_scan_all_files | Scan all files for secrets | no | — |
| soft_fail | do not return an error code if there are failed checks | no | — |
| framework | run only on a specific infrastructure | no | — |
| external_checks_dirs | comma separated list of external (custom) checks directories | no | — |
| external_checks_repos | comma separated list of external (custom) checks repositories | no | — |
| output_format | The format of the output. cli, json, junitxml, github_failed_only, or sarif | no | sarif |
| output_file_path | Path and name for output file. | no | — |
| download_external_modules | download external terraform modules from public git repositories and terraform registry:true, false | no | — |
| log_level | log level | no | WARNING |
| config_file | checkov configuration file | no | — |
| baseline | Path to a .checkov.baseline file to compare. Report will include only failed checks that are not in the baseline | no | — |
| soft_fail_on | Do not return an error code only for specific check identifiers (comma separated) | no | — |
| hard_fail_on | Return an error code only for specific check identifiers (comma separated) | no | — |
| container_user | Set the username or UID used and optionally the groupname or GID for the action to run under | no | 0 |
| docker_image | Name of the docker image with the tags. Only works with an API and Dockerfile path | no | — |
| dockerfile_path | Path to the Dockerfile of the scanned docker image | no | — |
| var_file | Variable files to load in addition to the default files. Currently only supported for source Terraform (.tf file), and Helm chart scans. Requires using --directory, not --file. | no | — |
| github_pat | Environment variable name for a Github personal access token for scanning external modules sourced from private repositories | no | — |
| tfc_token | Environment variable name for a Terraform Cloud token for scanning external modules sourced from private registries | no | — |
| vcs_base_url | Environment variable name for the base url of a self hosted VCS with external modules. To be used with vcs_username and vcs_token | no | — |
| vcs_username | Environment variable name for the username for basic auth against a self hosted VCS with external modules. To be used with vcs_base_url and vcs_token | no | — |
| vcs_token | Environment variable name for the password (personal access token) for basic auth against a self hosted VCS with external modules. To be used with vcs_base_url and vcs_username | no | — |
| bitbucket_token | Environment variable name for a Bitbucket access token to scan external modules sourced from a private Bitbucket repository | no | — |
| bitbucket_app_password | Environment variable name for a Bitbucket app password to perform basic auth inorder to scan external modules sourced from a private Bitbucket repository. To be used with bitbucket_usernam | no | — |
| bitbucket_username | Environment variable name for a Bitbucket username to perform basic auth inorder to scan external modules sourced from a private Bitbucket repository. To be used with bitbucket_app_password | no | — |
| repo_root_for_plan_enrichment | Directory containing the hcl code used to generate a given plan file. Use with `file` | no | — |
| policy_metadata_filter | comma separated key:value string to filter policies based on Prisma Cloud policy metadata. See https://prisma.pan.dev/api/cloud/cspm/policy#operation/get-policy-filters-and-options for information on allowed filters. Format: policy.label=test,cloud.type=aws | no | — |
Outputs
| name | description |
|---|---|
| results | The results from the scan |