juancardesa/Secret Scanner CLI
Scan a repository, organization, or local checkout for exposed secrets and upload SARIF results to GitHub code scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target-type | What to scan: 'local', 'repo', or 'org'. | no | local |
| target | Path to scan for 'local', 'owner/repo' for 'repo', or organization name for 'org'. | no | . |
| branch | Branch to scan. Only used when target-type is 'repo' or 'org'. | no | "" |
| exclude | Comma-separated exclude glob patterns, e.g. "*.min.js,dist/*". | no | "" |
| severity | Minimum confidence level to report: low, medium, or high. | no | "" |
| include-history | Also scan recent commit diffs. Only used when target-type is 'repo' or 'org'. | no | false |
| max-commits | Number of commits to scan when include-history is true. | no | "" |
| baseline | Path to a baseline file of previously accepted findings. | no | "" |
| fail-on-findings | Fail the job if any findings remain after filtering. | no | true |
| github-token | GitHub token used for 'repo' or 'org' scans. Not required for target-type 'local'. | no | "" |
| sarif-path | Path to write the SARIF report to. | no | secret-scanner-results.sarif |
Outputs
| name | description |
|---|---|
| sarif-path | Path to the generated SARIF report. |
| exit-code | Exit code returned by the secret-scanner CLI. |