lejouni/Application Security Analsysis tools

This action will use other security scanning tools to do different type of security scannings.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Maintainedlast commit Jan 26, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: lejouni/appsec-scan@a374bd6c40091b851dbe606b2ba97ce5cebdb182 # no releases — HEAD as of 2026-07-11

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
log_level	Logging level. Default is INFO.	no	INFO
cache	Tools can be cached by setting this to true. Default is true.	no	true
build_command	Application build command. Ex. mvn clean install	no	—
github_token	Pass the GitHub token to the script in order to create PRs	no	—
bridge_install_folder	Install folder for Bridge component	no	/tmp/bridge-cli-bundle
bridge_platform	Bridge platform linux is default. Options are linux64, win64 and macosx	no	linux64
bridge_version	Bridge component version	no	3.11.0
polaris_project	Project name, if not given then default=github.repository	no	${{github.repository}}
polaris_branch	Project branch name, if not given then default=github.ref_name	no	${{github.ref_name}}
polaris_url	URL for Polaris where the thin client can be downloaded	yes	—
polaris_token	Polaris Access Token	yes	—
polaris_config_overrides	With this you can overriding the configuration file. More info: https://documentation.blackduck.com/bundle/coverity-on-polaris/page/topics/c_cli-config-overrides.html	no	--co analyze.coverity.cov-analyze='["--enable", "HARDCODED_CREDENTIALS", "--security", "--webapp-security", "--android-security"]'
polaris_analysis_mode	Analysis mode will tell the action that is local or central analysis requested, Options are local and central (Default).	no	central
polaris_config_file	By giving this input, you specify which polaris.yaml file to use. If this is given, then only configurations given inside of the config file, will be used. If not given then will set polaris server url with flag -s	no	—
polaris_sarif	By setting this true, you will get results output as a sarif format file. Default is false.	no	false
polaris_sarif_file	If polaris_sarif: true, then this is used, to specify the output file with full path. Default: github.workspace/polaris-scan-results.sarif.json	no	${{github.workspace}}/polaris-scan-results.sarif.json
polaris_issue_status	Indicates which issues are returned based on the status, if not given, then all are returned. Options are opened,closed.	no	—
polaris_install_folder	To which folder the tools are extracted. Default is /tmp/cache/polaris	no	/tmp/cache/polaris
polaris_platform	What platform of Polaris thin client is needed, example: linux64 (Default). Fow Windows win64 and for MacOS macosx	no	linux64
polaris_version	What version of Polaris thin client is needed, example: 2025.6.0 (Default)	no	2025.6.0
polaris_nextgen_application	Application name	no	—
polaris_nextgen_project	Project name, if not given then default=github.repository	no	${{github.event.repository.name}}
polaris_nextgen_branch	Project branch name, if not given then default=github.ref_name	no	${{github.branch.name}}
polaris_nextgen_url	URL for Polaris where the thin client can be downloaded	yes	—
polaris_nextgen_token	Polaris Access Token	yes	—
polaris_nextgen_sarif	By setting this true, you will get results output as a sarif format file. Default is false.	no	false
polaris_nextgen_sarif_file	If polaris_sarif: true, then this is used, to specify the output file with full path. Default: github.workspace/polaris-scan-results.sarif.json	no	${{github.workspace}}/polaris-scan-results.sarif.json
blackduck_url	URL for Black Duck where the thin client can be downloaded	yes	—
blackduck_token	Black Duck Access Token	yes	—
blackduck_project	Project name in Black Duck, if not given then default=github.repository	no	${{github.repository}}
blackduck_version	Project version name in Black Duck. Defaul is github.ref_name	no	${{github.ref_name}}
blackduck_detect_opts	Additional detect options. Comma separated list.	no	detect.tools="ALL"
blackduck_policy_categories	Which policy category vulnerabilites are returned. SECURITY,LICENSE is default.	no	SECURITY,LICENSE
blackduck_sarif	By setting this true, you will get results output as a sarif format file. Default is false.	no	false
blackduck_full_scan	Setting this to true, black duck full scan is executed, otherwise if blackduck is true, then RAPID -scan is done.	no	false
blackduck_policies	If given, policy information is added	no	false
blackduck_iac	If given, iac findings are added	no	false
blackduck_rapid_compare_mode	ALL - The default and existing Rapid Scan mode. The output is the same as before, no BOM comparisons are done. BOM_COMPARE_STRICT - If the policy violation was already known and visible in the project version's component page (active or overridden), it will not be in the Rapid Scan results. Only new violations found in the scanned project and cleared violations are returned. Only policy rules that are relevant to Rapid Scans and project version BOMs will be evaluated (those with Rapid and Full scan modes selected). BOM_COMPARE - Evaluates all policy rules that 'ALL' mode does but will apply the 'BOM_COMPARE_STRICT' logic to relevant policy rules (those with Rapid and Full scan modes selected).	no	ALL
blackduck_fixpr_enabled	Enables or disables Fix PRs creation for Black Duck. When set to true, a fix PR is created for each vulnerable direct dependency. Default is false.	no	false
blackduck_fixpr_maxCount	Sets the maximum number of fix pull requests that can be created on a branch. Accepts integer values	no	—
blackduck_fixpr_filter_severities	Creates Fix PRs only for issues with the severity level specified. The value is a comma-separated list. Supported severities are CRITICAL, HIGH, MEDIUM, LOW	no	—
blackduck_fixpr_useUpgradeGuidance	Allows the user to specify short-term or long-term upgrade guidance, or both. If both values are provided, the first takes priority, and the second value is used only if the first returns no results. If upgrade guidance is not available, the fix PR is not created.	no	SHORT_TERM, LONG_TERM
blackduck_prComment_enabled	Option to enable pull request comments for new issues found in the pull request. Baseline full scan results must exist on the server for this feature to work	no	false
blackduck_scan_failure_severities	Black Duck scan failure severities. Accepted severities are ALL, NONE, BLOCKER, CRITICAL, MAJOR, MINOR, OK, TRIVIAL, UNSPECIFIED. Default "NONE"	no	NONE
blackduck_toolname_for_sarif_full	Given name is used for sarif tool name for Black Duck full scan results. Default is Black Duck Intelligent	no	BlackDuck SCA Intelligent
blackduck_toolname_for_sarif_rapid	Given name is used for sarif tool name for Black Duck rapid scan results. Default is Black Duck Intelligent	no	BlackDuck SCA Rapid
coverity_url	URL for coverity.	yes	—
coverity_username	Coverity Connect username	yes	—
coverity_passphare	Coverity Connect password	yes	—
coverity_project	Project name, if not given then default=github.repository	no	${{github.repository}}
coverity_stream	Project stream name, if not given then default=github.ref_name	no	${{github.ref_name}}
coverity_repository_name	Project repository name	no	—
coverity_branche_name	Project branch name	no	—
coverity_sarif	Project branch name	no	false
coverity_local	Set to false if you are using Coverity cloud deployment	no	false
coverity_tool_name	Tool name for Sarif	no	Coverity
coverity_sarif_file	If coverity_sarif: true, then this is used, to specify the output file with full path. Default: github.workspace/coverity-scan-results.sarif.json	no	${{github.workspace}}/coverity-scan-results.sarif.json
polaris	If this is true, then Polaris analysis is done. Default is false.	no	false
polaris_nextgen	If this is true, then Nextgen Polaris analysis is done. Default is false.	no	false
blackduck	If this is true, then Black Duck analysis is done. Default is false.	no	false
coverity	If this is true, then Cloud Native Coverity (coverity) analysis is done. Default is false.	no	false

Outputs

no outputs