socketdev/Security Scan and Comment Action
Runs various open source security tools and then comments on PRs with results.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github_token | GitHub token to post comments on PRs | yes | — |
| python_sast_enabled | Enable Python SAST analysis | no | false |
| golang_sast_enabled | Enable Golang SAST analysis | no | false |
| javascript_sast_enabled | Enable JavaScript SAST analysis | no | false |
| dockerfile_enabled | Enable Dockerfile analysis | no | false |
| image_enabled | Enable image scanning | no | false |
| secret_scanning_enabled | Enable secret scanning | no | false |
| docker_images | Comma-separated list of Docker images to scan | no | "" |
| dockerfiles | Comma-separated list of Dockerfiles to scan | no | "" |
| trufflehog_exclude_dir | Comma-separated list of directories to exclude in Trufflehog | no | "" |
| trufflehog_rules | Rules to enable in Trufflehog | no | "" |
| trufflehog_show_unverified | Show unverified secrets in Trufflehog results | no | false |
| bandit_exclude_dir | Comma-separated list of directories to exclude in Bandit | no | "" |
| bandit_rules | Rules to disable in Bandit | no | "" |
| gosec_exclude_dir | Comma-separated list of directories to exclude in Gosec | no | "" |
| gosec_rules | Rules to enable in Gosec | no | "" |
| trivy_exclude_dir | Comma-separated list of directories to exclude in Trivy | no | "" |
| trivy_rules | Rules to enable in Trivy | no | "" |
| eslint_exclude_dir | Comma-separated list of directories to exclude in ESLint | no | "" |
| eslint_rules | Custom ESLint rules or plugins to enable | no | "" |
| sumo_logic_enabled | Enable Sumo Logic log forwarding | no | false |
| sumo_logic_http_source_url | HTTP source URL for Sumo Logic | no | "" |
| ms_sentinel_enabled | Enable Microsoft Sentinel log forwarding | no | false |
| ms_sentinel_workspace_id | Workspace ID for Microsoft Sentinel | no | REPLACE_ME |
| ms_sentinel_shared_key | Shared key for Microsoft Sentinel | no | REPLACE_ME |
| scan_all | If true, always scan the whole directory regardless of git or file list. | no | false |
| scan_files | Comma-separated list of files to scan. If not set, will use git diff or scan all. | no | "" |
Outputs
no outputs