cassiodeveloper/SecScore
Security scoring engine for CI/CD pipelines. Convert SARIF findings into a single score and security decision.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 7, 2026
- License
- None
Pinned Snippet
uses: cassiodeveloper/secscore@d6920698acf972a89a03ae29d326fd3d56555112 # v0.5.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| findings | Path to findings.json (generated by your scanners/normalizers) | no | — |
| policy | Path to SecScore policy YAML | no | policy/policy-default.yml |
| sarif | Path to one or more SARIF files. Accepts a single path or a comma-separated list of paths. Example: "semgrep.sarif,trivy.sarif" | no | — |
| no_diff_aware | Set to 'true' to disable diff-aware filtering (enabled by default) | no | false |
| base_ref | Git ref to diff against for diff-aware filtering (default: origin/main) | no | origin/main |
| label_review | Label to apply when decision is REVIEW | no | secscore-review |
| check_name | Name of the GitHub Check Run | no | SecScore |
| provider | Provider name for context (e.g. 'checkmarx', 'snyk') | no | — |
| checkmarx-project | Checkmarx project name for context | no | — |
| checkmarx-base-url | Checkmarx base URL for context | no | — |
| checkmarx-token | Checkmarx token for context | no | — |
| checkmarx-tenant | Checkmarx tenant for provider mode | no | — |
| token | Generic token for integrations (used by M.A.R.I.A) | no | — |
| maria-url | M.A.R.I.A API endpoint URL to receive consolidated findings | no | — |
| maria-token | M.A.R.I.A bearer token (overrides token) | no | — |
| maria-import-policy | Set to 'true' or 'false' to control M.A.R.I.A policy import behavior | no | — |
| maria-repository-id | M.A.R.I.A repository id (GUID) for submissions endpoint | no | — |
| maria-pull-request-id | Pull request id to send to M.A.R.I.A (auto-detected in GitHub pull_request events when omitted) | no | — |
| branch | Branch name for context | no | — |
| html_output | Set to 'true' to generate secscore-report.html from secscore-result.json | no | false |
| html_out | Path to the generated HTML report | no | secscore-report.html |
Outputs
| name | description |
|---|---|
| decision | PASS | REVIEW | FAIL |
| score | 0-100 score |
| exit_code | 0=PASS, 1=REVIEW, 2=FAIL |