| base-uri | The CxOne server base URL, default is the US1 environment. https://checkmarx.com/resource/documents/en/34965-68630-configure.html#UUID-494287f8-3019-2542-c111-cb147c286bac_id_ASTCLIConfigurationEnvironmentVariables-CLIConfigurationParameters | no | https://ast.checkmarx.net |
| base-auth-uri | The CxOne server base URL, default is the US1 environment. https://checkmarx.com/resource/documents/en/34965-68630-configure.html#UUID-494287f8-3019-2542-c111-cb147c286bac_id_ASTCLIConfigurationEnvironmentVariables-CLIConfigurationParameters | no | https://iam.checkmarx.net |
| cx-tenant | The CxOne tenant identifier. | yes | — |
| cx-client-id | OAuth Client ID for API access | yes | — |
| cx-client-secret | OAuth client secret key for API access | yes | — |
| project-name | Scan project name | no | ${{ github.repository }} |
| additional-scan-params | Additional parameters passed to the CxOne CLI after "scan create" | no | "" |
| cx-cli-debug | Turn on debugging for the CxOne CLI and the composite action. | — | false |
| cx-cli-agent | The agent name to use when performing CxOne CLI commands. This value will show as the "Scan Origin" of each scan. | — | cxonepp-gh-action |
| cx-cli-additional-params | Additional parameters to pass to the CxOne CLI (proxy settings, etc) for all CxOne CLI invocations. | — | "" |
| resolver-additional-params | Additional parameters to pass to the SCA Resolver. | — | "" |
| build-container-tag | The container tag for the build environment where the scan will execute. If not provided, the scan executes in the runner. | no | — |
| docker-login-registry | The name of the container registry to use for login. | — | docker.io |
| docker-login-username | The username for the container registry login. | — | "" |
| docker-login-password | The password for the container registry login. | — | "" |
| upload-sarif-file | If true, uploads the Sarif file to create entries on the GitHub security tab during push events. | — | true |
| attach-sarif-file | If true, attaches the Sarif file to the workflow as an artifact for push or pull request events. | — | false |
| additional-report-params | Additional parameters used when compiling reports. Do not add the --filter option; use the "report-filters" input parameter to set filter options. | — | "" |
| report-filters | The criteria that selects what to include in any report results. | — | --filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" |
| attach-sbom-file | If true, attaches the SBOM file to the workflow as an artifact. | — | false |
| sbom-standard | The SBOM standard format used when generating the SBOM file. | — | CycloneDxJson |
| show-versions | If true, emits the versions of the CxOne CLI and SCA Resolver in the action log. | — | true |