| github_token | The GitHub Token. Required if any of the 'create*' options are turned on
You can choose to use a different token than the pipeline default `GITHUB_TOKEN`.
Eg: secrets.GITHUB_TOKEN | no | ${{ github.token }} |
| create_issue | If turned on an Issue will be created with the scan report.
Note: Only created on scan failure. | yes | false |
| create_pull_request_check | If turned on a Check on Pull Request will be created with the scan report | yes | false |
| create_pull_request_comment | If turned on a Comment on the Pull Request will be created with the scan report | yes | false |
| prisma_api_url | The URL for Prisma Cloud varies depending on the region and cluster on which your tenant is deployed.
The tenant provisioned for you is, for example, https://app2.prismacloud.io or https://app.eu.prismacloud.io.
Replace 'app' in the URL with 'api' and enter it here.
Refer to the Prisma Cloud REST API Reference (https://api.docs.prismacloud.io/reference#try-the-apis) for more details. | yes | — |
| access_key | The access key enables programmatic access.
If you do not have a key, refer to Create and Manage Access Keys (https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/manage-prisma-cloud-administrators/create-access-keys.html) to acquire one.
We recommend the actual value to be stored as a GitHub Secret and used here in the Action with secrets.PRISMA_CLOUD_ACCESS_KEY | yes | — |
| secret_key | The secret key is provided to you at the time of Access Key generation.
You cannot view it on the Prisma Cloud web interface.
We recommend the actual value to be stored as a GitHub Secret and used here in the Action with secrets.PRISMA_CLOUD_SECRET_KEY | yes | — |
| asset_name | Can be a project name or any identifier you want to attach to the scan.
Some examples are a CI/CD project name or a Git repository name.
Eg: 'my-repo-name' | yes | — |
| tags | Prisma Cloud tags are different from cloud tags that you might have included in your IaC templates.
Prisma Cloud tags will facilitate use of upcoming Prisma Cloud features like role-based access control and policy selection.
Eg: 'owner:johndoe,team:creditapp,env:dev' | no | — |
| failure_criteria | Enables you to evaluate scan results against set failure criteria to obtain failed or passed verdicts.
You can set the count for high, medium, and low severity issues and use 'and'/'or' operators to refine your criteria.
The IaC scan API checks each severity violation number separately against scan results and applies the operator to each evaluation.
The scan triggers a failure if the number of violations is greater than or equal to the failureCriteria values.
The Pipeline will be set the Failed if the failure criteria matches. | no | High:1,Medium:1,Low:1,Operator:or |
| scan_path | Path of the directory containing the IaC files.
The path is relative to the repository root. | no | ./ |
| use_scan_path_when_pr | Specifies if files in scan_path should be scanned in context of a PR,
not only changed files. Otherwise, only files changed in context of PR
are scanned, which includes files outside of scan_path and excludes
unchanged files in scan_path. Default is false. | no | false |
| upload_scan_path_only | Specifies if only files in scan_path should be uploaded to be scanned.
By default the entire GitHub workspace directory is zipped and uploaded.
This option may be necessary if there are other files in the workspace
directory besides IaC template files. Too many files may cause the
action to timeout. | no | false |
| template_type | Specify the template type.
Valid values are as follows:
'TF' for Terraform
'CFT' for AWS CloudFormation
'K8S' for Kubernetes | yes | — |
| template_version | Specify the template version.
Valid values are: '0.11', '0.12' and '0.13'
Note: Only used for 'TF' templateType. | no | — |
| variables | Template variables in comma separate key:value pairs.
Eg: 'k1:v1,k2:v2' | no | — |
| variable_files | Comma separated list of variable file paths.
Paths are relative to the repository root.
Eg: './var1.json,./var2.json' | no | — |
| result_path | The directory relative to the workspace where scan result files will be stored | no | ./prismacloud_iac |
| ignore_ssl | Should internal API client ignore SSL errors.
Useful when using on GitHub Enterprise On-Prem behind SSL intercepting firewalls. | no | false |