rusowyler/SEC Checks - SAST & Supply Chain Scanner
Runs security checks using SAST and audit scripts for supply chain attacks
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| semgrep-config | Semgrep config to use (e.g. auto, p/owasp-top-ten, or a local path) | no | auto |
| custom-rules-path | Path to custom Semgrep rules directory | no | .semgrep/ |
| fail-on-severity | Minimum severity to fail the build (ERROR, WARNING, INFO) | no | ERROR |
| supply-chain-audit | Enable package.json supply chain audit | no | true |
| artifact-name | Name of the uploaded results artifact | no | semgrep-results |
| trusted-actions | Comma-separated action names allowed to use version tags instead of commit SHAs (e.g. actions/checkout, docker/login-action) | no | "" |
| pr-diff-mode | Use 'semgrep ci' (diff-aware) on pull requests and 'semgrep scan' on full runs. Set to 'false' to always use semgrep scan. | no | true |
Outputs
| name | description |
|---|---|
| findings-count | Total number of Semgrep findings |
| blocking-count | Number of findings at or above fail-on-severity |
| supply-chain-findings | Number of suspicious lifecycle scripts found |