opensecdevops/OSDO SAST
Static Application Security Testing with Semgrep, CodeQL, and language-specific analyzers
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 21, 2026
- License
- None
Pinned Snippet
uses: opensecdevops/osdo-sast@dedd9dc0fe20130d2959eb6cbdf0012c58f6e705 # v2.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan for security vulnerabilities | no | . |
| language | Programming language (auto, python, javascript, typescript, go, java, csharp, ruby, all) | no | auto |
| scanners | Scanners to use (semgrep, codeql, bandit, eslint, all) | no | semgrep |
| severity-threshold | Minimum severity to report (INFO, WARNING, ERROR) | no | WARNING |
| fail-on-finding | Fail the action if vulnerabilities are found | no | true |
| semgrep-rules | Semgrep ruleset (auto, p/security-audit, p/owasp-top-ten, p/cwe-top-25, custom path) | no | auto |
| results-dir | Directory to store results | no | .osdo/results |
Outputs
| name | description |
|---|---|
| findings | Total vulnerabilities found |
| critical-count | Critical severity count |
| high-count | High severity count |
| sarif-file | Path to SARIF output file |