innavoto/UTEM Security Scan
Run UTEM security scans in your CI/CD pipeline. Fails builds on findings above a configurable severity threshold.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| api-key | UTEM API key (from Settings -> API Tokens) | yes | — |
| base-url | UTEM API base URL | no | https://utem.innavoto.com |
| tenant-id | UTEM tenant ID | no | 1 |
| scan-type | Scan type: code, vulnerability, compliance, full | no | code |
| target | Scan target (repo name, URL, or path). Defaults to current repository. | no | ${{ github.repository }} |
| severity-threshold | Minimum severity to fail the build: critical, high, medium, low, info | no | high |
| fail-on-findings | Whether to fail the workflow if findings exceed threshold | no | true |
| timeout | Scan timeout in seconds | no | 300 |
| modules | Comma-separated scan modules to enable (e.g. sast,sca,secrets,iac) | no | "" |
| gate-mode | Enable CI/CD security gate. After scan, evaluates findings against gate policies and blocks merge on DENY. | no | false |
| dependency-audit | Enable dependency vulnerability scanning (pip-audit, npm audit, govulncheck) | no | false |
| sarif-file | Path to write the SARIF 2.1.0 report of findings, for upload via github/codeql-action/upload-sarif | no | utem-results.sarif.json |
Outputs
| name | description |
|---|---|
| scan-id | UTEM scan ID |
| findings-count | Total findings count |
| critical-count | Critical severity findings |
| high-count | High severity findings |
| medium-count | Medium severity findings |
| low-count | Low severity findings |
| scan-url | Link to scan results in UTEM dashboard |
| status | Scan result: pass or fail |
| gate-decision | Gate decision when gate-mode is enabled: ALLOW or DENY |
| gate-violations | JSON array of gate violation messages (when gate-mode=true) |
| sarif-path | Filesystem path of the generated SARIF report |