nellur35/taintly
Scan CI/CD pipelines (GitHub Actions, GitLab, Jenkins) for security issues
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to the repository or workflow directory to scan. | no | . |
| version | taintly version to install. Accepts any git ref the repo has (tag, branch, commit SHA). Default `v1` tracks the floating `v1` tag and advances with each v1.x.y release. Pin narrowly (e.g. `v1.1.1`) in security-critical consumers. | no | v1 |
| python-version | Python version used to run the scanner. Any 3.10+ works; 3.12 is fastest. | no | 3.12 |
| fail-on | Minimum severity that makes the action fail (CRITICAL/HIGH/MEDIUM/LOW/INFO). Default HIGH matches the tool's built-in exit-code convention. Set to an empty string to disable fail-on and rely on the built-in HIGH=exit-1, CRITICAL=exit-2 behaviour. | no | HIGH |
| min-severity | Suppress findings below this severity. Default INFO shows every finding; set HIGH for a quiet dashboard that only surfaces action-needed issues. | no | INFO |
| platform | Force a specific platform (github/gitlab/jenkins). Default auto-detects, which works for single-platform repos. Specify explicitly for dual-platform (e.g. repo has both .github/workflows/ AND .gitlab-ci.yml). | no | "" |
| format | Report format for stdout (text/json/csv/sarif/html). SARIF is also written separately via sarif-file when upload-sarif is true — this input controls what the action prints to the job log. | no | text |
| config | Path to .taintly.yml. Default auto-discovers at the scanned repo root; set to a custom path to override. | no | "" |
| exclude-rules | Comma or newline-separated rule IDs to exclude (e.g. SEC2-GH-002,SEC4-GH-002). Prefer a committed .taintly.yml for anything more than a handful of rules. | no | "" |
| baseline | Enable baseline mode. When set, pass --diff <baseline-file> to the scanner: only findings NOT in the baseline will be reported. Use for adopting the tool on a repo with pre-existing findings without breaking CI on day 1. | no | false |
| baseline-file | Path to the baseline JSON file. Default is .taintly-baseline.json, matching the scanner's built-in default. | no | .taintly-baseline.json |
| upload-sarif | When true, emit SARIF output to sarif-file so a subsequent github/codeql-action/upload-sarif step can send findings to the GitHub Security tab. The action itself does NOT upload — the caller runs the upload-sarif step so the permissions model (security-events: write) stays explicit in the caller's workflow. | no | false |
| sarif-file | Path where the SARIF report is written when upload-sarif is true. | no | taintly.sarif |
| extra-args | Extra CLI arguments passed through verbatim (e.g. '--transitive --score'). | no | "" |
Outputs
| name | description |
|---|---|
| exit-code | The scanner's exit code. 0 = clean, 1 = HIGH or fail-on threshold hit, 2 = CRITICAL. Exposed so downstream steps can gate on it without re-running the scan. |
| sarif-file | Path of the SARIF output (only meaningful when upload-sarif=true). |