hcl-tech-software/HCL AppScan Static Analyzer
Scan for security issues in code
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 1, 2026
- License
- Apache 2.0
Pinned Snippet
uses: hcl-tech-software/appscan-sast-action@1c05fa67a55c00709d80471aff864ae34e1ea547 # v1.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| asoc_key | API key for connecting to the AppScan service. | yes | — |
| asoc_secret | Secret for connecting to the AppScan service. | yes | — |
| service_url | The url of the AppScan service. | no | — |
| acceptssl | Allow connections to a service with an untrusted certificate. Recommended for testing purposes only. | no | false |
| application_id | The application id where your scan will appear. | yes | — |
| sast_scan_id | The ID of an existing SAST scan to use for running a rescan. | no | — |
| sca_scan_id | The ID of an existing SCA scan to use for running a rescan. | no | — |
| scan_name | The name of the scan created in the AppScan service. | no | ${{ github.event.repository.name }} |
| personal_scan | Make the scan a personal scan. | no | false |
| incremental_scan | Only scan added and modified files in a pull request. Incremental scans are only supported when the action is triggered by a pull request. | no | false |
| static_analysis_only | Only run static analysis. Do not run SCA (Software Composition Analysis). | no | false |
| open_source_only | Only run SCA (Software Composition Analysis). Do not run static analysis. | no | false |
| secrets_only | Only scan for secrets. Do not run static analysis or software composition analysis. | no | false |
| scan_build_outputs | By default only source code files will be analyzed. Enabling this option will result in build output files for Java and .NET to be analyzed (.jar/.war/.ear/.dll/.exe). Additionally, Maven, Gradle, and Visual Studio solutions will be built if the build environment is available. | no | false |
| wait_for_analysis | By default this action will initiate the scan in the AppScan service, but it will not wait for analysis to complete. Enabling this option will cause the action to wait for analysis to complete. Note that this will cause the action to run longer. | no | false |
| analysis_timeout_minutes | If wait_for_analysis is true, the number of minutes to wait for analysis to complete. The default is 30 minutes. | no | 30 |
| fail_for_noncompliance | If wait_for_analysis is true, fail the job if any non-compliant issues are found in the scan. | no | false |
| failure_threshold | If fail_for_noncompliance is enabled, the severity that indicates a failure. Lesser severities will not be considered a failure. For example, if failure_threshold is set to Medium, Informational and/or Low severity issues will not cause a failure. Medium, High, and/or Critical issues will cause a failure. | no | Low |
Outputs
no outputs