microsoft/DevSkim

Run DevSkim Code Analysis and output Sarif compatible with GitHub Code Scanning alerts

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Maintainedlast commit May 21, 2025
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: microsoft/devskim-action@4b5047945a44163b94642a1cecc0d93a3f428cc6 # v1.0.16

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
directory-to-scan	The sub directory of the repository root to scan. Repository root used by default.	no	GITHUB_WORKSPACE
should-scan-archives	Optionally scan the contents of archives.	no	false
output-filename	The filename for the output.	no	devskim-results.sarif
output-directory	The sub directory for the output under GITHUB_WORKSPACE.	no	GITHUB_WORKSPACE
ignore-globs	Optional comma separated list of file globs to ignore when scanning.	no	/.git/,/bin/
exclude-rules	Optional comma separated list of rule IDs to ignore	no	""
options-json	Optional path in the repository containing a json to provide to the --options-json argument	no	""
extra-options	Provide any other command line arguments for the DevSkim analyze command. See DevSkim documentation for usage instructions.	no	""

Outputs

no outputs