crowdstrike/CrowdStrike FCS CLI GitHub Action
Run FCS IaC or Image scan
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 14, 2026
- License
- Public domain
Pinned Snippet
uses: crowdstrike/fcs-action@340a86029db9fcb0287b5df183639f8d487dc206 # v4.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| bin_path | FCS binary installation path (defaults to $RUNNER_TEMP) | no | — |
| falcon_client_id | CrowdStrike API Client ID for authentication | yes | — |
| falcon_region | CrowdStrike API region. Allowed values are us-1, us-2, eu-1, us-gov-1, us-gov-2 | yes | us-1 |
| version | FCS CLI version to use | no | — |
| scan_type | Type of scan to perform: iac or image | no | iac |
| categories | Include results for the specified categories | no | — |
| config | Path to the scan configuration file | no | — |
| disable_secrets_scan | Disable scanning of secrets and passwords in target files | no | false |
| exclude_categories | Exclude results for the specified categories, accepts a comma-separated list | no | — |
| exclude_paths | Exclude paths from scan, accepts a comma-separated list (e.g. './sample-dir-to-omit/*,sample-file.tf') | no | — |
| exclude_platforms | Exclude results for the specified platforms, accepts a comma-separated list | no | — |
| exclude_severities | Exclude results for the specified severities, accepts a comma-separated list | no | — |
| fail_on | Comma-separated list of which kind of results should return an exit code different from 0 | no | — |
| output_path | Path to save the scan results. For IaC: file or directory path. For image scans: must be a file path with .json, .sarif, or .cdx.json extension, or omit to use CLI defaults | no | — |
| path | Path to local file, local directory or git repo to scan (e.g. ./my-local-dir, git::<git repo>, sample-file.tf) | no | — |
| platforms | Include results for the specified platforms, accepts a comma-separated list (e.g Ansible,CloudFormation) | no | — |
| policy_rule | IaC cloud scanning policy-rule. Use "local" for local rules, "default-iac-alert-rule" for cloud-based rules | no | local |
| project_owners | Comma-separated list of project owners to notify (max 5) | no | — |
| project_name | Name of the project for identification in Falcon console | no | — |
| report_formats | Comma-separated list of formats in which reports are to be written (e.g. json,sarif) | no | — |
| severities | Include results for the specified severities, accepts a comma-separated list (e.g. high,medium) | no | — |
| timeout | Timeout for the scan in seconds | no | — |
| upload_results | Upload scan results to the CrowdStrike Falcon Console | no | false |
| image | Container image to scan (e.g., nginx:latest, docker://image:tag) | no | — |
| socket | Custom socket path for container engine (e.g., unix:///var/run/docker.sock) | no | — |
| platform | Target platform(s) for multi-platform images. Single value or comma-separated list in OS/ARCH format (e.g., linux/amd64 or linux/amd64,linux/arm64) | no | — |
| vulnerability_only | Image scan for vulnerabilities only | no | false |
| sbom_only | Only generate Image SBOM in CycloneDX (json) format | no | false |
| minimum_score | Only show vulnerabilities with CVSS score at or above this threshold (0.0-10.0) | no | — |
| minimum_severity | Only show vulnerabilities with this severity or higher (low, medium, high, critical) | no | — |
| minimum_exprt | Only show vulnerabilities with this ExPRT rating or higher (low, medium, high, critical) | no | — |
| exclude_vulnerabilities | Comma-separated list of vulnerability IDs to exclude | no | — |
| vuln_fixable_only | Exclude vulnerabilities without a fix | no | false |
| report_sort_by | Sort report by vulnerability, ExPRT rating, severity or score in ascending or descending order | no | — |
| show_full_description | Show full vulnerability descriptions without truncation | no | false |
| show_full_detection_details | Show full detection details without truncation | no | false |
| minimum_detection_severity | Only show detections with this severity or higher (low, medium, high, critical) | no | — |
| no_color | Disable colored output for severity levels and ExPRT ratings | no | false |
| temp_dir | Custom directory for temporary files | no | — |
| strict_digest | Enable strict digest validation for container images (enforces digest consistency between build and registry) | no | false |
Outputs
| name | description |
|---|---|
| exit-code | Exit code of the FCS CLI tool. For IaC scans, determined by the fail_on parameter. For image scans, determined by the image assessment policy configured in the Falcon console. |