orcasecurity/Orca Security - IaC Security
Configures Orca CLI to run Infrastructure as Code security scans
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 6–8scored Jul 6, 2026
- Maintenance Recency
- Maintainedlast commit Feb 6, 2025
- License
- Apache 2.0
Pinned Snippet
uses: orcasecurity/shiftleft-iac-action@f171681da633548da011fa984c13b84f14744352 # v.1.5.12tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| api_token | Orca API Token used for Authentication | yes | — |
| exit_code | Exit code for failed execution due to policy violations | no | — |
| no_color | Disable color output | no | false |
| project_key | Project Key name | yes | — |
| silent | Disable logs and warnings output | no | false |
| disable_err_report | Suppress error reporting to the monitoring platform | no | false |
| path | Paths or directories to scan (comma-separated) | yes | — |
| exclude_paths | List of paths to be excluded from scan (comma-separated) | no | — |
| cloud_provider | Limit scan to the specified list of cloud providers (comma-separated) | no | — |
| format | Format for displaying the results | no | — |
| output | Output directory | no | — |
| platform | Limit scan to the specified list of platforms (comma-separated) | no | — |
| exclude_platform | Exclude the specified list of platforms from scan (comma-separated) | no | — |
| control_timeout | Number of seconds the control has to execute before being canceled | no | — |
| ignore_failed_exec_controls | Ignore any failures that happened while executing any of the controls | no | — |
| timeout | Set the maximum duration for the CLI execution. valid time units ("s", "m", "h") | no | — |
| preview_lines | Number of lines to be display in CLI results | no | — |
| show_failed_issues_only | Show only failed issues in CLI results | no | false |
| console_output | Prints results to console in the provided format (only when --output is provided) | no | — |
| config | Path to configuration file (json, yaml or toml) | no | — |
| show_annotations | Show github annotations on pull requests | no | true |
| custom_controls | Paths to custom controls (comma-separated) | no | — |
| generate_rego_input | Generates a JSON file in the desired location, containing an internal representation of scanned files, which can be utilized as input for Rego policies | no | — |
| terraform_vars_path | Path where terraform variables are present | no | — |
| include_compressed_files | Include compressed files in scan | no | false |
| max_file_size | Maximum file size to be scanned in MB. Bigger files will be skipped | no | — |
| display_name | Scan log display name (on Orca platform) | no | — |
| debug | Debug mode | no | false |
| log_path | The directory path to specify where the logs should be written to on debug mode. Default to the current working directory | no | — |
Outputs
| name | description |
|---|---|
| exit_code | The status of the scan |