| harness-token | Harness Personal Access Token or Service Account Token | yes | — |
| harness-domain | Harness domain (e.g., https://app.harness.io) | no | https://app.harness.io |
| harness-org-id | Harness Organization ID | yes | — |
| harness-project-id | Harness Project ID | yes | — |
| scanner | Scanner to use (bandit, snyk, aqua_trivy, grype, sonarqube, checkmarx, etc.) | yes | — |
| scan-mode | Scanner execution mode:
• orchestration - Plugin runs scanner and ingests results (default)
• ingestion - Upload pre-generated scan results file
• extraction - Fetch results from scanner's API/platform
| no | orchestration |
| scan-config | Scanner configuration profile:
• default - Use scanner's cloud/SaaS service (default)
• self-hosted - Use self-hosted scanner instance
• Scanner-specific values - See scanner documentation
| no | default |
| target-type | Type of scan: repository, container, instance, or configuration | no | repository |
| scanner-access-token | Scanner API token (for Snyk, Checkmarx, SonarQube, etc.) | no | — |
| scanner-access-id | Scanner username or access ID (for scanners requiring both ID and token) | no | — |
| scanner-domain | Scanner domain (for self-hosted scanners like SonarQube, Checkmarx) | no | — |
| scanner-region | Scanner service region (for cloud-based scanners with regional deployments) | no | — |
| scanner-project-name | Project name in scanner (for Checkmarx, SonarQube, etc.) | no | — |
| workspace | Path to code to scan (relative to GitHub workspace, for repository scans) | no | . |
| target-name | Target name for tracking (auto-detected from repository if not provided) | no | — |
| target-variant | Target variant/branch for tracking (auto-detected from branch if not provided) | no | — |
| image-name | Container image name/repository (for container scans, e.g., myapp, org/myapp) | no | — |
| image-tag | Container image tag or digest (for container scans, e.g., latest, v1.2.3, sha256:...) | no | — |
| image-domain | Container registry domain (for container scans, e.g., docker.io, gcr.io) | no | — |
| image-type | Container image type: docker_v2, local_image, aws_ecr, jfrog_artifactory, etc. | no | docker_v2 |
| image-access-id | Container registry username (for private registries) | no | — |
| image-access-token | Container registry password or token (for private registries) | no | — |
| instance-domain | Instance domain to scan (for instance/DAST scans, e.g., app.example.com) | no | — |
| instance-protocol | Instance protocol (for instance scans, e.g., https, http) | no | https |
| instance-path | Instance path (for instance scans, e.g., /api) | no | — |
| tool-args | Additional command-line arguments to pass to the scanner | no | — |
| docker-mode | Docker execution mode: with-docker-in-docker or without-docker-in-docker | no | — |
| capture-output | Capture scan output variables to file | no | true |
| output-file | Path to write scan output variables (relative to workspace) | no | scan-output.env |
| fail-on-severity | Fail build on this severity or higher (CRITICAL, HIGH, MEDIUM, LOW, NONE) | no | NONE |
| show-summary | Display vulnerability summary in logs | no | true |
| docker-image-tag | Tag for the Harness scanner Docker image | no | latest |
| scanner-env | Additional environment variables for advanced/beta features (KEY=value format, one per line).
Use this for variables not yet available as explicit inputs.
Common advanced variables:
• SCANNER_TEAM_NAME - Team name in scanner platform
• SCANNER_VERIFY_SSL - SSL verification (true/false)
• SCANNER_AUTH_TYPE - Authentication method
• SCANNER_API_VERSION - Scanner API version
• SCANNER_EXCLUDE - Files/paths to exclude from scan
• TOOL_TIMEOUT - Scanner timeout in seconds
Example:
scanner-env: |
SCANNER_TEAM_NAME=security-team
SCANNER_VERIFY_SSL=false
SCANNER_EXCLUDE=*.test.js,docs/**
TOOL_TIMEOUT=600
| no | — |