winther-s0ldier/Codaxes

Impact-weighted static analysis + call-graph security scan — surfaces the blast radius of every finding, not just the line.

Trust Signals

name	description	required	default
path	Directory to scan.	no	.
format	Output format: sarif \| github \| json \| table. Use 'sarif' for Code Scanning annotations.	no	sarif
since	Only scan files changed since this git ref (e.g. origin/main). Empty = full scan. Requires actions/checkout with fetch-depth: 0.	no	""
fail-on	Fail the job on findings at or above this severity: info \| warning \| error \| never.	no	error
sca	Also scan dependency lockfiles against OSV.dev for known CVEs (true/false).	no	false
output-file	Where to write the report.	no	codaxes.sarif
upload-sarif	Upload the SARIF report to GitHub Code Scanning (needs permissions: security-events: write). Only applies when format is 'sarif'.	no	true
extra-args	Extra arguments appended verbatim to the `codaxes scan` command.	no	""
python-version	Python version to run codaxes with.	no	3.11

name	description
report	Path to the generated report file.
exit-code	codaxes scan exit code (0 = clean, 1 = findings at/above fail-on, 2 = tool error).