vulnz/SAST Scanner — SCA + Secret Scanning
Free, fast SAST + SCA + secret scanning for CI. AST taint across 16 languages, SARIF to the GitHub Security tab.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Directory to scan (relative to the repo root). | no | . |
| fail-on | Fail the job (exit 2) if any finding is at or above this severity: critical | high | medium | low | info. Leave empty to report without failing the build. | no | "" |
| format | Comma-separated report formats: html, json, sarif. SARIF is always produced so it can be uploaded to the GitHub Security tab. | no | sarif,json,html |
| output | Directory to write report files into. | no | sast-report |
| upload-sarif | Upload the SARIF report to GitHub code scanning (Security tab). Requires `security-events: write` permission on the job. | no | true |
| secrets-only | Only scan for secrets / hardcoded credentials (fast). | no | false |
| no-sca | Skip the dependency CVE / dependency-confusion (SCA) pass. | no | false |
| changed-only | Scan only files changed vs the git HEAD (incremental). Requires a checkout with history. | no | false |
| version | sast pip package version to install (default: latest). | no | latest |
| args | Extra raw flags passed verbatim to the sast CLI (advanced). | no | "" |
| artifact-name | Name of the uploaded report artifact. Give each job a unique value when running this action in a matrix, otherwise the artifacts collide. | no | insomnia-sast-report |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF report. |
| exit-code | The sast CLI exit code (0 clean / 2 findings at-or-above fail-on / 1 error). |