paloaltonetworks/Cortex Cloud Scan
Run Cortex Cloud security scans for Code Security, Container Workload Protection, and API Security
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 29, 2026
- License
- Apache 2.0
Pinned Snippet
uses: paloaltonetworks/cortex-cloud-scan@3a5f413ae5a63d0da6d069eca9e628fece0603a7 # v1.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| api-base-url | Cortex Cloud API base URL | yes | — |
| api-key | Cortex Cloud API key | yes | — |
| api-key-id | Cortex Cloud API key ID | yes | — |
| scan-type | Type of scan to perform: code, image, or api | yes | — |
| directory | [Code] Directory path to scan | no | — |
| file | [Code] File path to scan | no | — |
| repo-id | [Code] Repository ID (format: owner/repo) | no | — |
| branch | [Code] Branch name | no | — |
| upload-mode | [Code] Upload mode: upload, no-upload, or no-code | no | upload |
| framework | [Code] Frameworks to scan (comma-separated) | no | — |
| skip-framework | [Code] Frameworks to skip (comma-separated) | no | — |
| severity | [Code] Filter by severity levels (comma-separated: critical,high,medium,low,unknown) | no | — |
| output-format | [Code] Output format: cli, json, spdx, junitxml, sarif, cyclonedx, cyclonedx_json | no | cli |
| output-file-path | [Code] Path for output file | no | — |
| soft-fail | [Code/Image] Do not fail pipeline on findings (true/false) | no | false |
| no-fail-on-crash | [Code/Image] Return exit code 0 on internal errors (true/false) | no | false |
| compact | [Code] Do not display code blocks in output (true/false) | no | false |
| skip-path | [Code] Path to skip during scan | no | — |
| create-repo-if-missing | [Code] Create repository if missing (true/false) | no | false |
| validate-secrets | [Code] Validate detected secrets (true/false) | no | false |
| image | [Image] Container image name to scan | no | — |
| archive | [Image] Scan from archive file (true/false) | no | false |
| archive-format | [Image] Archive format: docker-archive or oci-archive | no | docker-archive |
| docker-host | [Image] Path to Docker socket | no | — |
| ci-pipeline-id | [Image] CI pipeline identifier | no | — |
| ci-build-id | [Image] CI build identifier | no | — |
| image-timeout | [Image] Timeout in seconds | no | 60 |
| image-output-format | [Image] Output format: human-readable or json | no | human-readable |
| scanned-app-url | [API] Base URL of the application to scan | no | — |
| api-spec-file | [API] Path to API specification file | no | — |
| api-spec-type | [API] API specification type | no | openapi |
| auth-file | [API] Path to authentication file | no | — |
| java-location | [API] Path to Java binary (version >= 11) | no | java |
| api-timeout | [API] Scan timeout in seconds | no | 300 |
| concurrency | [API] Concurrency limit for scan requests | no | 5 |
| api-output-file | [API] Output path for report file | no | — |
| ca-certificate | Path to CA certificate for proxy/TLS inspection | no | — |
| no-cert-verify | Disable TLS certificate verification (true/false) | no | false |
| http-proxy | HTTP proxy server URL | no | — |
| log-level | Logging level: INFO, WARNING, ERROR | no | — |
| support | Generate support bundle with detailed logs (true/false) | no | false |
Outputs
| name | description |
|---|---|
| scan-result | Path to scan result file (if output file was specified) |
| exit-code | Exit code from the scan |
| support-bundle | Path to support bundle file (if support was enabled) |