digicert/DigiCert Code Monitoring Action
Runs CodeQL multi-language scan (languages auto from backend) and generates SBOM. Uploads artifacts for backend ingestion.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- MIT
Pinned Snippet
uses: digicert/digicert-code-monitoring-action@8f2d974a4e65bb7eac630b82d9b0ecd4c378d939 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| env | Backend environment to use (prod|stage) | no | prod |
| region | DC One region for authentication/routing (required) | yes | — |
| api-key | API key for DigiCert backend (pass via secrets) | yes | — |
| name | Repo-scoped scan name used to create/find a DC One external release and dedupe scans by (name + branch + commitSha). If with-release is true, this must be provided. | no | — |
| with-release | When true, require name and tag and build the scan name as '<name>-<tag>' so runs align with a specific release tag. | no | false |
| tag | Release tag used only when with-release is true (required when with-release is true). | no | — |
Outputs
no outputs