orcasecurity/Orca Security - Secret Detection (Git Repos)
Configures Orca CLI to run secrets scan on your code
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 4–6scored Jul 6, 2026
- Maintenance Recency
- Maintainedlast commit Feb 6, 2025
- License
- Apache 2.0
Pinned Snippet
uses: orcasecurity/shiftleft-secrets-action@5d7e24bc32e40bac7f49bf1957171d3ec49e9a9e # v1.0.5tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| api_token | Orca API Token used for Authentication | yes | — |
| exit_code | Exit code for failed execution due to policy violations | no | — |
| no_color | Disable color output | no | false |
| project_key | Project Key name | yes | — |
| silent | Disable logs and warnings output | no | false |
| disable_err_report | Suppress error reporting to the monitoring platform | no | false |
| max_secret | Maximum secrets that can be found, when reaching this number secret scan will stop | no | — |
| num_cpu | Number of logical CPUs to be used for secret scanning (default 10) | no | — |
| path | Path or directory to scan | no | . |
| disable_git_scan | Disable Git scan | no | false |
| ignore_git_history_baseline | Run full history scan | no | — |
| from_commit | The commit to scan from | no | — |
| to_commit | The commit to scan to | no | — |
| exceptions_filepath | Exceptions YAML file path. | no | — |
| format | Format for displaying the results | no | table |
| output | Output directory | no | — |
| timeout | Set the maximum duration for the CLI execution. valid time units ("s", "m", "h") | no | — |
| show_failed_issues_only | Show only failed issues in CLI results | no | false |
| console_output | Prints results to console in the provided format (only when --output is provided) | no | table |
| config | Path to the configuration file (json, yaml or toml) | no | — |
| show_annotations | Show GitHub annotations on pull requests | no | true |
| debug | Debug mode | no | false |
| disable_active_verification | Disable active verification | no | false |
| log_path | The directory path to specify where the logs should be written to on debug mode. Default to the current working directory | no | — |
Outputs
| name | description |
|---|---|
| exit_code | The exit code of the scan |