devsecai/Arko Scan

Upload the checked-out source to Arko, run a full security build scan, annotate findings on the changed code, and publish a step summary. Advisory by default — set fail-on to gate merges.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
api-token	Arko API token, sent as the X-Arko-Token header. Create one under Admin → API Access in the Arko console and store it as a repository secret. Preferred over bearer-token.	no	""
bearer-token	Alternative auth: a JWT sent as "Authorization: Bearer <jwt>". Only for setups that do not have an API token yet; api-token wins when both are provided.	no	""
api-base	Arko API base URL.	no	https://arko.devsecai.io
project-name	Project name as it appears in the Arko console. Defaults to the repository name.	no	${{ github.event.repository.name }}
branch	Branch recorded on the scan. Defaults to the PR head branch on pull_request events, otherwise the current ref name.	no	${{ github.head_ref \|\| github.ref_name }}
fail-on	Severity gate. Empty (the default) means ADVISORY — findings never fail the step. Set to critical, high, or medium to exit 1 when findings at or above that severity exist.	no	""
max-wait-seconds	Maximum seconds to wait for the scan to finish.	no	1200
exclude	Extra zip exclusion patterns, newline-separated (zip -x syntax, e.g. "docs/"). .git, node_modules, dist, build, .venv and .zip are always excluded.	no	""

Outputs

name	description
scan-id	The Arko scan id.
verdict	passing (no findings at/above the gate, or none at all), advisory (findings found but no fail-on gate set), failing (findings at/above the fail-on gate), error (the scan could not run or finish).
critical-count	Number of critical findings on this scan.
high-count	Number of high findings on this scan.
medium-count	Number of medium findings on this scan.
low-count	Number of low findings on this scan.