| qualys_access_token | Qualys API access token from Container Security module | yes | — |
| qualys_pod | Qualys platform POD (US1, US2, US3, US4, EU1, EU2, CA1, IN1, AU1, UK1, AE1, KSA1) | yes | US3 |
| scan_mode | Scanner mode override. Default (empty): runs inventory-only upload first, then fetches vuln report. Explicit values: inventory-only (upload only), scan-only (local only), get-report (upload + fetch), evaluate-policy (cloud policy). | no | "" |
| scan_path | Directory path to scan (defaults to repository root) | no | "" |
| exclude_dirs | Comma-separated directories to exclude from scan | no | "" |
| exclude_files | Comma-separated file patterns to exclude from scan | no | "" |
| use_policy_evaluation | Use Qualys cloud policy evaluation instead of local thresholds | no | false |
| policy_tags | Comma-separated policy tags for cloud policy evaluation | no | "" |
| max_critical | Maximum allowed critical vulnerabilities (-1 for unlimited) | no | 0 |
| max_high | Maximum allowed high vulnerabilities (-1 for unlimited) | no | 0 |
| max_medium | Maximum allowed medium vulnerabilities (-1 for unlimited) | no | -1 |
| max_low | Maximum allowed low vulnerabilities (-1 for unlimited) | no | -1 |
| scan_secrets | Enable secrets detection in source code | no | false |
| offline_scan | Perform offline scan without uploading to Qualys cloud | no | false |
| generate_sbom | Generate Software Bill of Materials (SBOM) | no | false |
| sbom_format | SBOM format (spdx, cyclonedx, or both) | no | spdx |
| scan_timeout | Scan timeout in seconds | no | 300 |
| upload_sarif | Upload SARIF results to GitHub Security tab | no | true |
| continue_on_error | Continue workflow even if vulnerabilities exceed thresholds | no | false |
| create_issues | Create GitHub Issues for discovered vulnerabilities | no | false |
| issue_min_severity | Minimum severity for issue creation (5=critical, 4=high, 3=medium, 2=low, 1=info) | no | 4 |
| issue_labels | Additional comma-separated labels for created issues | no | "" |
| issue_assignees | Comma-separated GitHub usernames to assign to created issues | no | "" |
| max_network_retries | Maximum number of retries when polling for the vulnerability report within a single scan attempt | no | 5 |
| network_retry_wait_min | Minimum wait time in seconds between report poll attempts | no | 10 |
| network_retry_wait_max | Maximum wait time in seconds between report poll attempts | no | 15 |
| report_fetch_retries | Number of times to re-run the full scan if the vulnerability report cannot be fetched from Qualys cloud | no | 3 |
| report_fetch_delay | Seconds to wait before retrying the full scan when the vulnerability report fetch fails | no | 60 |
| debug | Enable debug logging and performance stats | no | true |