sraisl/PolyScan
Multi-language SAST scan with Quality Gate, SARIF, CycloneDX SBOM and job summary — native TypeScript action
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Path to scan (default: repo root) | no | . |
| engines | Comma-separated engines to run, or 'all': semgrep,bandit,eslint,spotbugs,trivy,detekt,gitleaks | no | all |
| max-critical | Max critical findings allowed before the Quality Gate fails | no | 0 |
| max-high | Max high findings allowed before the Quality Gate fails | no | 0 |
| max-medium | Max medium findings allowed before the Quality Gate fails | no | 50 |
| gate | Enforce the Quality Gate (fail the job when thresholds are exceeded) | no | true |
| sarif | Write a SARIF 2.1.0 report (polyscan.sarif) | no | true |
| sbom | Write a CycloneDX SBOM (polyscan.sbom.json) | no | false |
| upload-artifacts | Upload SARIF + SBOM as workflow artifacts | no | true |
| upload-sarif | Emit a hint for uploading SARIF to GitHub code scanning (needs a follow-up upload-sarif step) | no | false |
| trivy-image | Docker image to scan with 'trivy image' (e.g. myapp:latest). Requires the image to be available in the local Docker daemon. Runs in addition to the filesystem scan. | no | "" |
| output-dir | Directory for generated reports | no | . |
Outputs
| name | description |
|---|---|
| total | Total number of findings |
| critical | Number of critical findings |
| high | Number of high findings |
| medium | Number of medium findings |
| low | Number of low findings |
| gate-passed | 'true' if the Quality Gate passed, otherwise 'false' |
| sarif-file | Path to the generated SARIF file (if any) |
| sbom-file | Path to the generated SBOM file (if any) |