jhl-labs/Security CLI Action

Install security-cli from jhl-labs/dist and publish scan findings as GitHub Actions annotations.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 15, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: jhl-labs/security-cli-action@4b5b383f2f18841ed470dfb85dc9084b9b909aad # no releases — HEAD as of 2026-07-11

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
token	GitHub token used by checkout and security-cli tool installation.	no	${{ github.token }}
checkout	Whether this action should checkout the repository before scanning.	no	true
repository	Repository to checkout.	no	${{ github.repository }}
ref	Git ref to checkout.	no	${{ github.ref }}
fetch-depth	Checkout fetch depth. Use 0 when secret scanning needs Git history.	no	0
version	security-cli version to install, such as v0.1.8. Use latest for the newest public release.	no	latest
target	Path or artifact target passed to security-cli.	no	.
command	security-cli command to run.	no	diagnose
profile	security-cli profile.	no	ci
output-dir	Directory where security-cli writes reports.	no	reports/security
formats	Comma-separated security-cli output formats.	no	stdout,json,sarif
install-tools	Install the default scanner toolchain before scanning.	no	true
update-db	Update scanner vulnerability databases before scanning.	no	false
annotation-limit	Maximum number of GitHub Actions annotations to emit.	no	200
fail-on-findings	Return the security-cli exit code after annotations are emitted.	no	true
usage-tracking	Send usage metrics to SE Actions Space. Requires SE_ACTIONS_API_KEY in the caller environment.	no	true
usage-action-slug	Action slug registered in SE Actions Space for usage metrics.	no	security-cli-action
se-actions-base-url	SE Actions Space base URL used for usage metrics.	no	https://actions.euno.work
se-actions-origin-ip	Optional origin IP used to bypass an external proxy for usage metrics smoke tests.	no	""
extra-args	Extra arguments appended to the security-cli command.	no	""

Outputs

name	description
exit-code	security-cli exit code.
duration-seconds	security-cli execution duration in seconds.
report-dir	Directory containing security-cli reports.