fabasoad/SARIF to Slack notification

GitHub action sends notification to Slack based on SARIF file

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 9, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: fabasoad/sarif-to-slack-action@b8699587a714b2b385ffd1f7aa3406af84c92955 # v3.0.6

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
slack-webhook	Target Slack webhook URL.	yes	—
username	Slack message username.	no	—
icon-url	Slack message icon.	no	—
color	Default color of the Slack message if specific color was not found. It is a fallback option.	no	—
color-empty	Color of the message when there are no findings in the provided SARIF file(s).	no	—
color-severity-critical	Color of the message when at least one finding has "Critical" severity.	no	—
color-severity-high	Color of the message when at least one finding has "High" severity.	no	—
color-severity-medium	Color of the message when at least one finding has "Medium" severity.	no	—
color-severity-low	Color of the message when at least one finding has "Low" severity.	no	—
color-severity-none	Color of the message when at least one finding has "None" severity.	no	—
color-severity-unknown	Color of the message when at least one finding has "Unknown" severity.	no	—
color-level-error	Color of the message when at least one finding has "Error" level.	no	—
color-level-warning	Color of the message when at least one finding has "Warning" level.	no	—
color-level-note	Color of the message when at least one finding has "Note" level.	no	—
color-level-none	Color of the message when at least one finding has "None" level	no	—
color-level-unknown	Color of the message when at least one finding has "Unknown" level	no	—
sarif-path	Path to the directory with SARIF files or to the SARIF file itself. Separate Slack messages will be sent for each SARIF file found in the directory.	yes	—
sarif-path-recursive	If provided SARIF path is a directory, whether to traverse provided SARIF path recursively or not.	no	false
sarif-file-extension	Extension for SARIF files. Possible values: sarif, json.	no	sarif
log-level	Log level of output. Possible options are "silly", "trace", "debug", "info", "warning", "error", "fatal". This parameter is ignored if CI pipeline is running in debug mode, e.g. ACTIONS_STEP_DEBUG is set to "true".	no	info
log-template	Specifies the custom log message template to format log outputs, using the same template format as the tslog npm library. More details here: https://github.com/fullstack-build/tslog?tab=readme-ov-file#pretty-templates-and-styles-color-settings	no	[{{logLevelName}}] [{{name}}] {{dateIsoStr}}
log-colored	Whether logs should be colored or not.	no	true
header	Slack message header.	no	—
include-header	Whether to include header in the message.	no	true
footer	Slack message footer.	no	—
include-footer	Whether to include footer in the message.	no	true
actor	Who triggered the run.	no	${{ github.actor }}
include-actor	Whether to include actor in the message.	no	true
include-run	Whether to include run in the message.	no	true
representation	Slack message representation. Possible values: compact-group-by-run-per-level, compact-group-by-run-per-severity, compact-group-by-tool-name-per-level, compact-group-by-tool-name-per-severity, compact-group-by-sarif-per-level, compact-group-by-sarif-per-severity, compact-total-per-level, compact-total-per-severity.	no	compact-group-by-tool-name-per-severity
send-if	Condition on when Slack message should be sent. Possible values: severity-critical, severity-high, severity-high-or-higher, severity-medium, severity-medium-or-higher, severity-low, severity-low-or-higher, severity-none, severity-none-or-higher, severity-unknown, severity-unknown-or-higher, level-error, level-warning, level-warning-or-higher, level-note, level-note-or-higher, level-none, level-none-or-higher, level-unknown, level-unknown-or-higher, always, some, empty, never.	no	always

Outputs

no outputs