Third-Party Scanners #4
vulnetix-scanners.yml
on: workflow_dispatch
Bandit (Python SAST)
31s
Bearer (SAST)
1m 59s
Brakeman (Ruby on Rails SAST)
20s
cdxgen (multi-ecosystem SBOM)
1m 11s
Checkov (IaC)
2m 17s
Rust Clippy (SAST)
18s
Cppcheck (C/C++ SAST)
17s
CycloneDX Go SBOM
52s
CycloneDX Maven (SBOM)
30s
CycloneDX npm SBOM
35s
CycloneDX PHP SBOM
18s
CycloneDX Ruby SBOM
19s
CycloneDX Rust SBOM
17s
detect-secrets (secrets)
37s
detekt (Kotlin SAST)
39s
Dockle (container image)
51s
ESLint (JavaScript lint)
39s
Flawfinder (C/C++ SAST)
24s
GitHub SBOM (SPDX)
22s
Gitleaks (Secrets)
29s
golangci-lint (Go lint)
53s
gosec (Go SAST)
50s
govulncheck (Go SCA)
51s
Grype (SCA)
2m 16s
Grype image (OCI)
2m 14s
Hadolint (Dockerfile)
30s
KICS (IaC)
1m 33s
mobsfscan (Mobile SAST)
33s
njsscan (Node SAST)
32s
Nosey Parker (secrets)
23s
npm audit (Node SCA)
35s
OpenGrep (SAST)
1m 31s
OSV-Scanner (SCA)
34s
OWASP Dependency-Check (SCA)
3h 40m
PMD (Java SAST)
21s
Psalm (PHP SAST)
20s
Regula (IaC policy)
26s
Retire.js (JavaScript SCA)
43s
RuboCop (Ruby lint)
27s
Ruff (Python lint)
25s
ScanCode Toolkit (license SBOM)
4m 54s
Semgrep (SAST)
30s
ShellCheck (shell lint)
26s
SwiftLint (Swift lint)
41s
Syft (CycloneDX SBOM)
33s
Syft image (CycloneDX SBOM)
29s
Terrascan (Terraform)
38s
TFLint (Terraform)
18s
tfsec (Terraform)
36s
Trivy config (IaC/Dockerfile)
56s
Trivy (filesystem CDX + SARIF)
1m 11s
Trivy image (OCI)
18s
TruffleHog (secrets)
35s
zizmor (GitHub Actions SAST)
36s
Publish to Vulnetix
1m 57s
Annotations
6 errors, 56 warnings, and 21 notices
|
Brakeman (Ruby on Rails SAST)
Error: Could not convert version to a float
at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11)
at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37)
at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3)
at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11)
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3
at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12)
at Module._compile (node:internal/modules/cjs/loader:1854:14)
at Object..js (node:internal/modules/cjs/loader:1985:10)
at Module.load (node:internal/modules/cjs/loader:1577:32)
|
|
PMD (Java SAST)
File pmd-report.sarif does not exist
|
|
CycloneDX Ruby SBOM
Error: Could not convert version to a float
at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11)
at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37)
at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3)
at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11)
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3
at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12)
at Module._compile (node:internal/modules/cjs/loader:1854:14)
at Object..js (node:internal/modules/cjs/loader:1985:10)
at Module.load (node:internal/modules/cjs/loader:1577:32)
|
|
RuboCop (Ruby lint)
Error: Could not convert version to a float
at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11)
at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37)
at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3)
at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11)
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3
at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12)
at Module._compile (node:internal/modules/cjs/loader:1854:14)
at Object..js (node:internal/modules/cjs/loader:1985:10)
at Module.load (node:internal/modules/cjs/loader:1577:32)
|
|
Semgrep (SAST)
Process completed with exit code 1.
|
|
Publish to Vulnetix
Process completed with exit code 1.
|
|
cdxgen (multi-ecosystem SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Checkov (IaC)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Checkov (IaC)
No files were found with the provided path: results.sarif. No artifacts will be uploaded.
|
|
Brakeman (Ruby on Rails SAST)
No files were found with the provided path: brakeman.sarif. No artifacts will be uploaded.
|
|
CycloneDX Rust SBOM
No files were found with the provided path: cyclonedx-rust.cdx.json. No artifacts will be uploaded.
|
|
Rust Clippy (SAST)
No files were found with the provided path: clippy.sarif. No artifacts will be uploaded.
|
|
Rust Clippy (SAST)
clippy produced no valid SARIF; dropping the artifact
|
|
Bandit (Python SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Cppcheck (C/C++ SAST)
No files were found with the provided path: cppcheck.sarif. No artifacts will be uploaded.
|
|
Cppcheck (C/C++ SAST)
cppcheck could not be installed on this runner; skipping
|
|
PMD (Java SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: pmd/pmd-github-action@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
PMD (Java SAST)
No files were found with the provided path: pmd-report.sarif. No artifacts will be uploaded.
|
|
Ruff (Python lint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
OSV-Scanner (SCA)
No files were found with the provided path: osv.sarif. No artifacts will be uploaded.
|
|
OSV-Scanner (SCA)
No lockfiles found. Please use the --allow-no-lockfiles flag to suppress this warning.
|
|
npm audit (Node SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
npm audit (Node SCA)
No files were found with the provided path: npm-audit.sarif. No artifacts will be uploaded.
|
|
Grype (SCA)
Failed minimum severity level. Found vulnerabilities with level 'medium' or higher
|
|
Retire.js (JavaScript SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
govulncheck (Go SCA)
No files were found with the provided path: govulncheck.sarif. No artifacts will be uploaded.
|
|
govulncheck (Go SCA)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
CycloneDX Ruby SBOM
No files were found with the provided path: cyclonedx-ruby.cdx.json. No artifacts will be uploaded.
|
|
njsscan (Node SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
detect-secrets (secrets)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Flawfinder (C/C++ SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CycloneDX Maven (SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CycloneDX Maven (SBOM)
Error: Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.
|
|
CycloneDX Maven (SBOM)
No files were found with the provided path: cyclonedx-maven.cdx.json. No artifacts will be uploaded.
|
|
CycloneDX Maven (SBOM)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
|
|
CycloneDX Go SBOM
No files were found with the provided path: cyclonedx-go.cdx.json. No artifacts will be uploaded.
|
|
CycloneDX Go SBOM
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
golangci-lint (Go lint)
No files were found with the provided path: golangci-lint.sarif. No artifacts will be uploaded.
|
|
golangci-lint (Go lint)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
Grype image (OCI)
Failed minimum severity level. Found vulnerabilities with level 'medium' or higher
|
|
CycloneDX npm SBOM
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CycloneDX npm SBOM
No files were found with the provided path: cyclonedx-node.cdx.json. No artifacts will be uploaded.
|
|
detekt (Kotlin SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
detekt (Kotlin SAST)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
|
|
zizmor (GitHub Actions SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
ESLint (JavaScript lint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
ESLint (JavaScript lint)
No files were found with the provided path: eslint.sarif. No artifacts will be uploaded.
|
|
gosec (Go SAST)
No files were found with the provided path: gosec.sarif. No artifacts will be uploaded.
|
|
gosec (Go SAST)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
TFLint (Terraform)
No files were found with the provided path: tflint.sarif. No artifacts will be uploaded.
|
|
TFLint (Terraform)
tflint could not be installed on this runner; skipping
|
|
CycloneDX PHP SBOM
No files were found with the provided path: cyclonedx-php.cdx.json. No artifacts will be uploaded.
|
|
Trivy image (OCI)
No files were found with the provided path: trivy-image.sarif. No artifacts will be uploaded.
|
|
Psalm (PHP SAST)
No files were found with the provided path: psalm.sarif. No artifacts will be uploaded.
|
|
mobsfscan (Mobile SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Dockle (container image)
No files were found with the provided path: dockle.sarif. No artifacts will be uploaded.
|
|
Dockle (container image)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
ScanCode Toolkit (license SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Semgrep (SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Semgrep (SAST)
No files were found with the provided path: semgrep.sarif. No artifacts will be uploaded.
|
|
OWASP Dependency-Check (SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
OWASP Dependency-Check (SCA)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
|
|
Brakeman (Ruby on Rails SAST)
no Rails app detected; skipping Brakeman
|
|
CycloneDX Rust SBOM
no Cargo project found; skipping CycloneDX Rust
|
|
npm audit (Node SCA)
no package-lock.json found; skipping npm audit
|
|
govulncheck (Go SCA)
no go.mod found; skipping govulncheck
|
|
CycloneDX Ruby SBOM
no Gemfile.lock found; skipping CycloneDX Ruby
|
|
CycloneDX Maven (SBOM)
no pom.xml found; skipping CycloneDX Maven
|
|
CycloneDX Go SBOM
no go.mod found; skipping CycloneDX Go
|
|
golangci-lint (Go lint)
no go.mod found; skipping golangci-lint
|
|
Grype image (OCI)
no Dockerfile or Containerfile found; skipping
|
|
CycloneDX npm SBOM
no package-lock.json found; skipping CycloneDX npm
|
|
ESLint (JavaScript lint)
no package.json found; skipping ESLint
|
|
gosec (Go SAST)
no go.mod found; skipping gosec
|
|
CycloneDX PHP SBOM
no composer.lock found; skipping CycloneDX PHP
|
|
Trivy image (OCI)
no image was built; skipping Trivy image scan
|
|
Trivy image (OCI)
no Dockerfile or Containerfile found; skipping
|
|
CycloneDX PHP SBOM
passwordless sudo is unavailable on this runner; using the PHP already installed
|
|
Psalm (PHP SAST)
no composer.json found; skipping Psalm
|
|
Psalm (PHP SAST)
passwordless sudo is unavailable on this runner; using the PHP already installed
|
|
Syft image (CycloneDX SBOM)
no Dockerfile or Containerfile found; skipping
|
|
Dockle (container image)
no Dockerfile or Containerfile found; skipping Dockle
|
|
Terrascan (Terraform)
terrascan found no IaC files
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
bandit
Expired
|
25.1 KB |
sha256:acecd09e2e155a04cce0226b6a728b6339099622ce703a31037fba50b0b78efa
|
|
|
bearer
Expired
|
140 KB |
sha256:04a035995b505199cc49669a565be63afe10a743758717d554998bf8eda9146a
|
|
|
cdxgen
Expired
|
4.48 KB |
sha256:91053ea8fe529bafee98110f499bea09d83d7e4a84444bc4d728a5c2a1817f8f
|
|
|
dependency-check
Expired
|
27.8 KB |
sha256:945da8ea1818718b9abc2994b3d5beb75dc104b8e6901e05afa3c8e20190e0c7
|
|
|
detect-secrets
Expired
|
3.3 KB |
sha256:468401dca4ca16a793ee9743248b90b24e69c35999e93f4577aa9ec875e09ec0
|
|
|
detekt
Expired
|
13 KB |
sha256:b21476d211369a93059dd6155bd9e62eeab0cecfaa5278cfb0457c507dae17ab
|
|
|
flawfinder
Expired
|
3.08 KB |
sha256:329cfea8a45f24c478d28e765ef49ab8891cbc34c97e7c6ee0f8489fb0f446bd
|
|
|
github-sbom
Expired
|
2.48 KB |
sha256:735078295506e205aad2188de6b3d4626fb74564a867215fe6545a85765c42e0
|
|
|
gitleaks
Expired
|
8.26 KB |
sha256:c2e0e2c8e8a97c5c127c7017a7cbb8a35dcfca258e24ffc727c62f7af1dd9025
|
|
|
grype
Expired
|
5.81 KB |
sha256:45de42d0a08bc1b1c09a82ae3a7daee56ceff8cbebbaa69545b79176380ef58a
|
|
|
grype-image
Expired
|
5.82 KB |
sha256:f23dc4ec26c853d8c8f64e482f6fd9dda8497723670a963730707e2d8947ec65
|
|
|
hadolint
Expired
|
145 Bytes |
sha256:99a2f7519917deb4ce139f2e7b14351348f4c95328498bf6505d258ad200a248
|
|
|
kics
Expired
|
22.3 KB |
sha256:f76e6b32798d808bed4372b14be18e403733266e149dfceae177d552fb4c7c73
|
|
|
mobsfscan
Expired
|
3.44 KB |
sha256:6de4db5b32999c1a0c26eea7ba3aaba6e329124605c770f3446358c874f8603c
|
|
|
njsscan
Expired
|
867 Bytes |
sha256:36500bdc871fda4457a9b1fd49d4506c6eac849b77247e3685ddc6e3291472a9
|
|
|
noseyparker
Expired
|
19.5 KB |
sha256:38c017aca78924b5e987d6fd897d60c0dbf7ef538ea664cd31d871b3b01fc797
|
|
|
opengrep
Expired
|
262 KB |
sha256:9dd4dcb9e55bf825d01caf28bc8eedba70bde003abdf370c07d716103104acc2
|
|
|
regula
Expired
|
6.98 KB |
sha256:11e2e0d0e3999853aca392ef17fe77cb27d31fdad3c741a439acc2939ebddde9
|
|
|
retirejs
Expired
|
464 Bytes |
sha256:8e9c927ad1693db0c3e570bd38ce45755430434fce5baac6703c0ad36ea70d1c
|
|
|
rubocop
Expired
|
313 Bytes |
sha256:4554d6274d3278965dd6570621d5629b56a5ea5b266460afde715420392b2fff
|
|
|
ruff
Expired
|
20.2 KB |
sha256:7656aa81f6a2d7e6d28839c120b9bf6f3058c16edb32718068e051cebc680760
|
|
|
sbom.cdx.json
Expired
|
7.06 KB |
sha256:480e7d2da5705a5c3888a117852a88d091a8e19d1d3f4a5c88ca1dc7dc977ce5
|
|
|
scancode
Expired
|
5.48 KB |
sha256:9be4a3ab647f1f13e910f1585c42438799e005d6289425009a7ccca80663b99a
|
|
|
shellcheck
Expired
|
927 Bytes |
sha256:34edfb9ee6eebb1d5acf466e0fa7dfe303a7cce85c9dad196e06fcbc9b594a1f
|
|
|
swiftlint
Expired
|
14.6 KB |
sha256:8746fca8edfc83cffbcc53c0f44359cbb776e6887d40b631462a4855a9193f80
|
|
|
syft
Expired
|
7.06 KB |
sha256:480e7d2da5705a5c3888a117852a88d091a8e19d1d3f4a5c88ca1dc7dc977ce5
|
|
|
syft-image
Expired
|
7.07 KB |
sha256:133ef4c6da049e6a87decbbea9d23e320c92f2578d27aeb82d9222ab0e29d91f
|
|
|
terrascan
Expired
|
7.53 KB |
sha256:11b03edb50774e7520d737fe6cdce0fd1e776523c8d9a7a3b5c9c9f76c503ea5
|
|
|
tfsec
Expired
|
1.94 KB |
sha256:f38df85c79ad6b8b145e5d940d0519d6ccfef5395cb87179c574232380a57937
|
|
|
trivy-config
Expired
|
7.71 KB |
sha256:37126e04fd3cb9580551091d532416bd618a813ad30c69dd6b1aea1474796bcd
|
|
|
trivy-fs
Expired
|
21.2 KB |
sha256:16097f4a903691ddc9d18e6662bf4120803e005bb7d2f32391823fbdc8e47af9
|
|
|
trufflehog
Expired
|
996 Bytes |
sha256:324d0aff6f1ea84bfefd7ba55d1405e1c009a38a28454b8dde29685ee6f2ccb1
|
|
|
zizmor
Expired
|
6.76 KB |
sha256:6b50743d12dbcd69ff8953017190656d261503cf23af6d93653a437f06fa4298
|
|