checkmarx-ts/Checkmarx CxFlow++ GitHub Action
Orchestrates vulnerability scanning and issue tracker item lifecycle.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 29, 2026
- License
- Apache 2.0
Pinned Snippet
uses: checkmarx-ts/checkmarx-cxflow-plusplus-github-action@b2db66a69b2ab35081ac6ab555371c11833824d0 # v3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| project-name | The name of the scan project. This should include the branch being scanned using your organization's established system naming convention. The string `{branch}` will be replaced by the event's branch name if found in the project name. | — | — |
| app-name | The name of the application used when making issue tracker tags. | — | — |
| sast-url | The base URL to the Checkmarx SAST server (do not include CxWebClient). | no | — |
| sast-team | The full path of the SAST team that owns the project to scan. | no | /CxServer |
| sast-username | The username of the SAST account to use for scanning. | no | — |
| sast-password | The password for the selected SAST account. | no | — |
| sca-tenant | The name of the SCA tenant. | no | — |
| sca-username | The username of the SCA account to use for scanning. | no | — |
| sca-password | The password for the selected SCA account. | no | — |
| cxflow-jar-path | The local path to the CxFlow jar. If blank, CxFlow will be downloaded. | — | "" |
| cxflow-version | The CxFlow version to use for execution. Ignored if cxflow-jar-path is set. | — | latest |
| cxflow-params | Command line parameters to pass to CxFlow at every execution. | — | — |
| pull-request-cxflow-params | Command line parameters passed to CxFlow only when executing during a pull-request event. | — | — |
| push-cxflow-params | Command line parameters passed to CxFlow only when executing during a push event. | — | — |
| docker-login-registry | The name of the container registry to use for login. | — | docker.io |
| docker-login-username | The username for the container registry login. | — | "" |
| docker-login-password | The password for the container registry login. | — | "" |
| upload-sarif-file | Uploads the Sarif file to create entries on the GitHub security tab during push events. | — | true |
| delete-sarif-file | Set to "false" when using the Sarif feedback channel to keep the Sarif file at the path returned in the sarif-path output parameter. | — | true |
| default-branch | The default branch of the repository used as the root parent project in SAST from which branch projects are derived. This defaults to the repo's defined default branch. | — | ${{ github.event.repository.default_branch }} |
| disable-sast-scan | Set to true to disable SAST scanning. | — | false |
| disable-sca-scan | Set to true to disable SCA scanning. | — | false |
| enable-wire-trace | Set to true to emit web API I/O wire tracing to the action logs. | — | false |
| sast-log-level | The logging level for CxFlow output emitted as the action executes. (TRACE, DEBUG, ERROR, INFO) | — | INFO |
| java-opts | Options to pass to the JVM. | — | -Xms512m -Xmx2048m |
| java-props | Properties to pass to the JVM. | — | -Djava.security.egd=file:/dev/./urandom |
| push-feedback-channel | The feedback channel to use when scanning for a push. | — | Sarif |
| pull-request-feedback-channel | The feedback channel to use when scanning for a pull request. | — | GITHUBPULL |
| application-yaml-path | A path to a CxFlow yaml configuration file. | — | "" |
| build-container-tag | Set the the tag of the container used to perform the code build. SCA Resolver will execute in an instance of this container to obtain an accurate dependency tree. | — | "" |
| break-on-manifest-failure | — | — | true |
| scaresolver-tag | The tag for the containerized SCAResolver build environment where the action will execute dependency scanning. The image must not be built with a *-bare target. If this is not supplied, the SCA dependency scan will execute on the SCA server. | — | "" |
| spring-props | Spring boot properties to pass to the JVM. | — | "" |
| custom-ca-path | Path to a file or directory containing a custom CA cert chain that is imported into the Java runtime cacerts store. | — | "" |
Outputs
| name | description |
|---|---|
| sarif-path | The path to the Sarif file produced from the scan. |