jonjozwiak/OpenGrep Scanner
Run OpenGrep static analysis security testing with configurable rules and outputs
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | OpenGrep version to use | no | v1.16.1 |
| config | Rule configuration (auto, path to config file, or inline rules) | no | auto |
| paths | Paths to scan (space-separated) | no | . |
| output-format | Output format: json, sarif, text, gitlab-sast, gitlab-secrets, junit-xml, semgrep-json | no | json |
| output-file | Output file path | no | opengrep-results.json |
| severity | Minimum severity level: INFO, WARNING, ERROR | no | INFO |
| exclude | Exclude patterns (space-separated) | no | "" |
| include | Include patterns (space-separated) | no | "" |
| max-target-bytes | Maximum bytes to scan per file | no | 1000000 |
| timeout | Timeout in seconds | no | 1800 |
| jobs | Number of parallel jobs (0 = auto-detect) | no | 0 |
| max-memory | Maximum memory in MB (0 = unlimited) | no | 0 |
| baseline-commit | Git commit to use as baseline for differential scanning | no | "" |
| diff-depth | Git diff depth for changed files scanning | no | 2 |
| enable-metrics | Enable OpenGrep anonymous metrics | no | false |
| verbose | Enable verbose output | no | false |
| no-git-ignore | Ignore .gitignore files | no | false |
| verify-signature | Verify binary signature using Cosign | no | true |
| fail-on-findings | Fail the action if findings are detected | no | false |
| upload-artifacts | Upload results as GitHub artifacts | no | true |
| artifact-name | Name for uploaded artifact | no | opengrep-results |
Outputs
| name | description |
|---|---|
| results-file | Path to the results file |
| findings-count | Number of findings detected |
| critical-count | Number of critical/high severity findings |
| scan-exit-code | OpenGrep scan exit code |