newnormal-security/NewScan Security Scan
Run a NewScan API/web security scan as a CI gate — SARIF output + severity fail. Requires NewScan Pro.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target | http(s) URL to scan (required for api/web modes) | yes | — |
| license | NewScan Pro license token — store as a secret and pass secrets.NEWSCAN_LICENSE | yes | — |
| scan-mode | api | web | network | wifi | segmentation | — | api |
| profile | quick | baseline | full | safe (quick/baseline need no provider key) | — | quick |
| fail-on | severity that fails the job: critical | high | medium | low | info | — | high |
| sarif | path (within the workspace) to write SARIF 2.1.0 | — | newscan.sarif |
| goal | optional scan goal | — | "" |
| model | optional model id (full/safe profiles) | — | "" |
| token-budget | optional AI token budget | — | "" |
| config | optional path to a UI-exported JSON config (extra options: auth, scope, roles) | — | "" |
| extra-headers | Extra request headers so the scan can reach a PRE-PROD target through preview-protection or a WAF allow rule. One "Name: Value" per line, sent on every request. Example (Vercel protected preview): "x-vercel-protection-bypass: ${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}". | — | "" |
| api-base | NewNormal license/token service base URL (override for testing only) | — | https://newnormalsecurity.com |
Outputs
| name | description |
|---|---|
| sarif | path to the written SARIF file |
| exit-code | gate exit code — 0 pass, 1 finding at/above fail-on, 2 error |