glogai/Glog Scan Action
Scan source code and provide remediation advice for fixing only the real issues
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 18, 2026
- License
- None
Pinned Snippet
uses: glogai/glog-action@b751e1605418e440e596db3cc1b0e08a4103b140 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| lang | List of languages to scan separated by a comma e.g.: java,c,python | no | — |
| client | Specify client name. | no | — |
| env | Specify environment name like: 'dev' for https://<client>.dev.glog.ai. Default is none: https://<client>.glog.ai | no | — |
| ignore | List of directories to be skipped separated by a comma e.g.: dir1,dir2 | no | — |
| debug | Enable debug logging | no | false |
| upload | Upload Glog assessment file to Github Security page | no | true |
| on-prem-upload | Upload scan results to On-Prem Dashboard (passes --upload to resolver scanner) | no | false |
| path | Relative path | no | . |
| github-token | Optional GitHub token. If omitted, the workflow's built-in GITHUB_TOKEN is used automatically. Provide a PAT only if you need broader scopes (e.g. private GHCR pulls, cross-repo issue creation). | no | "" |
| glog-token | — | yes | — |
| issue | Upload Glog issues as Github issues. Default is false. | no | false |
| autofix | Automatically create PR for the issues found. Default is false. | no | false |
| max-issues | Maximum number of SARIF findings to convert into GitHub issues per run. Default is 30. | no | 30 |
| max-assign | Maximum number of created issues to assign to Copilot for autofix. Default is 30. | no | 30 |
| files | List of files to scan separated by a comma e.g.: src/A.java,src/B.java | no | — |
| inventory | Force the inventory scanner to run regardless of language auto-detection. Default is false. | no | false |
| sbom | Generate a CycloneDX SBOM via the resolver scanner (passes --with-sbom). If on-prem-upload=true the SBOM is also persisted on the server alongside the SARIF; otherwise it stays local in .glog/. Default is false. | no | false |
| sbom-only | Skip SARIF and only produce the SBOM (passes --sbom-only to the resolver). Implies sbom=true. Default is false. | no | false |
| scl-uuid | Source Code Location UUID to bind scan results (SARIF/SBOM) to on the Glog server. If omitted, the server tries to match an existing SCL from the scan metadata and creates one if no match is found. | no | — |
Outputs
no outputs