codethreat/CodeThreat Security Scan

Run CodeThreat security analysis and upload results to GitHub Security tab

Trust Signals

name	description	required	default
api-key	CodeThreat API key	yes	—
server-url	CodeThreat server URL	yes	—
organization-slug	CodeThreat organization slug (required - found in organization settings)	yes	—
repository-url	Repository URL to scan (defaults to current repository)	no	${{ github.repositoryUrl }}
branch	Branch to scan	no	${{ github.ref_name }}
wait-for-completion	Wait for scan completion before proceeding	no	true
timeout	Scan timeout in seconds (default: 43200 = 12 hours)	no	43200
poll-interval	Status polling interval in seconds	no	30
output-format	Output format (json, sarif, csv, xml, junit)	no	sarif
output-file	Output file name	no	codethreat-results.sarif
upload-sarif	Automatically upload SARIF to GitHub Security tab	no	true
fail-on-critical	Fail the build if critical vulnerabilities are found	no	false
fail-on-high	Fail the build if high severity vulnerabilities are found	no	false
max-violations	Maximum number of violations before failing (0 = no limit)	no	0
skip-import	Skip repository import if already imported	no	true
verbose	Enable verbose logging	no	false
github-token	GitHub token for SARIF upload (pass secrets.GITHUB_TOKEN)	no	—

name	description
scan-id	ID of the completed scan
repository-id	ID of the imported repository
results-file	Path to the results file
violation-count	Total number of violations found
critical-count	Number of critical violations
high-count	Number of high severity violations
medium-count	Number of medium severity violations
low-count	Number of low severity violations
security-score	Security score (0-100)
scan-duration	Scan duration in seconds
scan-url	URL to view scan results in CodeThreat dashboard