redrays-io/RedRays ABAP Security Scanner

Scan ABAP source for security vulnerabilities via the RedRays MC agent API (/agent/v1). Supports SARIF for GitHub code scanning.

Trust Signals

name	description	required	default
api-key	RedRays developer PAT (X-RedRays-Api-Key). Pass a secret, e.g. ${{ secrets.REDRAYS_TOKEN }}. Never logged.	yes	—
api-url	MC agent base URL ending in /agent/v1 (e.g. https://mc.example.com/agent/v1).	no	http://localhost:8080/agent/v1
scan-dir	Directory searched recursively for *.abap files. Ignored when 'files' is set.	no	.
files	Comma-separated list of specific ABAP files. Overrides scan-dir when set.	no	""
output-format	Report format: csv \| html \| json \| sarif. Use 'sarif' to upload to GitHub code scanning.	no	html
output-file	Path to write the report to. Leave blank to auto-name with the format's extension (recommended, esp. for sarif).	no	""
fail-on-vulnerabilities	Fail the job if any vulnerability is found. Only consulted when 'threshold' is empty.	no	true
threshold	Severity gate: critical \| high \| medium \| low \| informational. Job fails if any finding is at or above this severity.	no	""
scan-profile	Scan profile code: QUICK \| FULL \| CRITICAL \| CRITICAL_HIGH. Blank/unknown -> CRITICAL_HIGH default (per MC contract).	no	CRITICAL_HIGH

name	description
report-path	Actual path of the produced report file.
vulnerabilities-found	Total number of findings returned by the scan.
threshold-breached	'true' if the severity gate (threshold or fail-on-vulnerabilities) was breached.
scan-id	The MC session GUID for this scan.