duriantaco/ca9 Python Supply Chain Security

Run ca9 Python CVE reachability and SCA triage in GitHub Actions

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 27, 2026
License: MPL 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: duriantaco/ca9@a8aa385837b8c7251a91336bf8269201497e90c2 # v0.5.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
command	ca9 command to run. Use scan or check.	no	scan
report	SCA report path. Required when command is check.	no	""
repo	Repository path to analyze.	no	.
coverage	coverage.py JSON path for dynamic evidence.	no	""
format	Output format: sarif, json, vex, remediation, action-plan, markdown, html, or table.	no	sarif
output	Output file path.	no	ca9.sarif
proof-standard	Proof policy for suppressions: strict or balanced.	no	strict
capabilities	Attach AI capability blast radius to reachable CVEs.	no	false
trace-paths	Trace exploit paths from entry points to vulnerable call sites.	no	false
threat-intel	Enrich with EPSS scores and CISA KEV data.	no	false
otel-traces	OTLP JSON export for production runtime evidence.	no	""
no-auto-coverage	Disable automatic coverage discovery and generation.	no	false
accepted-risks	Accepted-risk TOML/JSON file for findings that should not affect gates.	no	""
baseline	Previous ca9 JSON report for new-only gating.	no	""
new-only	Only gate on reachable or inconclusive findings not present in the baseline.	no	false
upload-sarif	Upload SARIF output to GitHub code scanning when format is sarif.	no	true
fail-on-findings	Fail the workflow when ca9 exits non-zero for reachable or inconclusive findings.	no	false
extra-args	Additional ca9 CLI arguments split on shell whitespace.	no	""

Outputs

name	description
exit-code	ca9 exit code.
output-path	Path to the ca9 output file.