dudelzon/HCL AppScan Static Analyzer
Scan for security issues in code
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stalelast commit Sep 17, 2024
- License
- Apache 2.0
Pinned Snippet
uses: dudelzon/appscan-sast-actions@287007ca54a816c70ff50d0c68bf3c9bf33a6af3 # v1.0.6tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| asoc_key | API key for connecting to the AppScan service. | yes | — |
| asoc_secret | Secret for connecting to the AppScan service. | yes | — |
| service_url | The url of the AppScan service. | no | — |
| acceptssl | Allow connections to a service with an untrusted certificate. Recommended for testing purposes only. | no | false |
| application_id | The application id where your scan will appear. | yes | — |
| scan_name | The name of the scan created in the AppScan service. | no | — |
| personal_scan | Make the scan a personal scan. | no | false |
| static_analysis_only | Only run static analysis. Do not run SCA (Software Composition Analysis). | no | false |
| open_source_only | Only run SCA (Software Composition Analysis). Do not run static analysis. | no | false |
| scan_build_outputs | By default only source code files will be analyzed. Enabling this option will result in build output files for Java and .NET to be analyzed (.jar/.war/.ear/.dll/.exe). Additionally, Maven, Gradle, and Visual Studio solutions will be built if the build environment is available. | no | false |
| wait_for_analysis | By default this action will initiate the scan in the AppScan service, but it will not wait for analysis to complete. Enabling this option will cause the action to wait for analysis to complete. Note that this will cause the action to run longer. | no | false |
| analysis_timeout_minutes | If wait_for_analysis is true, the number of minutes to wait for analysis to complete. The default is 30 minutes. | no | 30 |
| fail_for_noncompliance | If wait_for_analysis is true, fail the job if any non-compliant issues are found in the scan. | no | false |
| failure_threshold | If fail_for_noncompliance is enabled, the severity that indicates a failure. Lesser severities will not be considered a failure. For example, if failure_threshold is set to Medium, Informational and/or Low severity issues will not cause a failure. Medium, High, and/or Critical issues will cause a failure. | no | Low |
Outputs
no outputs