orcasecurity/Orca Security - SCA / Secret Scanning
Configures Orca CLI to run secret detection and/or vulnerabilities scanning
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 4–6scored Jul 6, 2026
- Maintenance Recency
- Maintainedlast commit Feb 6, 2025
- License
- Apache 2.0
Pinned Snippet
uses: orcasecurity/shiftleft-fs-action@2a15c5a09ac3ead1d7a5d2ce9fdf911cdfaae3a7 # v1.1.6tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| api_token | Orca API Token used for Authentication | yes | — |
| exit_code | Exit code for failed execution due to policy violations | no | — |
| no_color | Disable color output | no | false |
| project_key | Project Key name | yes | — |
| silent | Disable logs and warnings output | no | false |
| disable_err_report | Suppress error reporting to the monitoring platform | no | false |
| disable_secret | Disables the secret detection scanning | no | false |
| hide_vulnerabilities | Do not show detailed view of the vulnerabilities findings | no | false |
| num_cpu | Number of logical CPUs to be used for secret scanning (default 10) | no | — |
| path | Paths or directories to scan (comma-separated) | yes | — |
| exceptions_filepath | exceptions YAML filepath. | no | — |
| custom_secret_controls | path to custom secret controls file. | no | — |
| format | Format for displaying the results | no | table |
| output | Output directory | no | — |
| timeout | Set the maximum duration for the CLI execution. valid time units ("s", "m", "h") | no | — |
| show_failed_issues_only | Show only failed issues in CLI results | no | false |
| console_output | Prints results to console in the provided format (only when --output is provided) | no | table |
| config | path to configuration file (json, yaml or toml) | no | — |
| show_annotations | show github annotations on pull requests | no | true |
| display_name | Scan log display name (on Orca platform) | no | — |
| hide_skipped_vulnerabilities | filter out skipped vulnerabilities from result | no | false |
| max_secret | Set the maximum secrets that can be found, when reaching this number secret scan will stop | no | — |
| exclude_paths | List of paths to be excluded from scan (comma-separated). Example: './notToBeScanned/,example.tf' | no | — |
| dependency_tree | Show dependency origin tree of vulnerable packages | no | false |
| security_checks | List of security issues to detect (comma-separated) | no | vulns,secret |
| debug | Debug mode | no | false |
| disable_active_verification | Disable active verification | no | false |
| log_path | The directory path to specify where the logs should be written to on debug mode. Default to the current working directory | no | — |
Outputs
| name | description |
|---|---|
| exit_code | The exit code of the scan |