orcasecurity/Orca Security - SCA Security
Configures Orca CLI to run Software Composition Analysis (SCA) scans for vulnerability and license detection
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 25, 2026
- License
- Apache 2.0
Pinned Snippet
uses: orcasecurity/shiftleft-sca-action@fc42aa7df50543c666a13e0977e64dbee6ac491b # v1.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| api_token | Orca API Token used for Authentication | yes | — |
| exit_code | Exit code for failed execution due to policy violations | no | — |
| no_color | Disable color output | no | false |
| project_key | Project Key name | yes | — |
| silent | Disable logs and warnings output | no | false |
| disable_err_report | Suppress error reporting to the monitoring platform | no | false |
| path | Path or directory to scan | yes | — |
| security_checks | List of security issues to detect (comma-separated: vulns, license, malicious) | no | vulns,license,malicious |
| exceptions_filepath | Path to exceptions YAML file | no | — |
| exclude_paths | List of paths to be excluded from scan (comma-separated) | no | — |
| format | Format for displaying the results (table, json, sarif, glsast, gl-dependency-scan) | no | table |
| output | Output directory | no | — |
| console_output | Prints results to console in the provided format (only when --output is provided) | no | table |
| hide_vulnerabilities | Do not show detailed view of the vulnerabilities findings | no | false |
| hide_skipped_vulnerabilities | Filter out skipped vulnerabilities from result | no | false |
| show_failed_issues_only | Show only failed issues in CLI results | no | false |
| dependency_tree | Show dependency origin tree of vulnerable packages | no | false |
| non_strict_package_detection | Detect vulnerabilities with version ranges instead of exact versions | no | false |
| skip_remote_lookup | Do not perform remote lookups for package information | no | false |
| timeout | Set the maximum duration for the CLI execution. valid time units ("s", "m", "h") | no | — |
| config | Path to configuration file (json, yaml or toml) | no | — |
| show_annotations | Show github annotations on pull requests | no | true |
| display_name | Scan log display name (on Orca platform) | no | — |
| debug | Debug mode | no | false |
| log_path | The directory path to specify where the logs should be written to on debug mode. Default to the current working directory | no | — |
| file_patterns | Use this flag when you have dependency files with non-standard names that the scanner wouldn't recognize by default. Indicate which analyzer (e.g., Python, Docker, npm) to use for a specific file pattern. Format: <analyzer>:<path> . Example: pip:requirements-.*\.txt | no | — |
Outputs
| name | description |
|---|---|
| exit_code | The exit code of the scan |