Skip to content

Third-Party Scanners #4

Third-Party Scanners

Third-Party Scanners #4

Manually triggered August 26, 2026 08:36
Status Failure
Total duration 4h 27m 41s
Artifacts 33

vulnetix-scanners.yml

on: workflow_dispatch
Bandit (Python SAST)
31s
Bandit (Python SAST)
Bearer (SAST)
1m 59s
Bearer (SAST)
Brakeman (Ruby on Rails SAST)
20s
Brakeman (Ruby on Rails SAST)
cdxgen (multi-ecosystem SBOM)
1m 11s
cdxgen (multi-ecosystem SBOM)
Checkov (IaC)
2m 17s
Checkov (IaC)
Rust Clippy (SAST)
18s
Rust Clippy (SAST)
Cppcheck (C/C++ SAST)
17s
Cppcheck (C/C++ SAST)
CycloneDX Go SBOM
52s
CycloneDX Go SBOM
CycloneDX Maven (SBOM)
30s
CycloneDX Maven (SBOM)
CycloneDX npm SBOM
35s
CycloneDX npm SBOM
CycloneDX PHP SBOM
18s
CycloneDX PHP SBOM
CycloneDX Ruby SBOM
19s
CycloneDX Ruby SBOM
CycloneDX Rust SBOM
17s
CycloneDX Rust SBOM
detect-secrets (secrets)
37s
detect-secrets (secrets)
detekt (Kotlin SAST)
39s
detekt (Kotlin SAST)
Dockle (container image)
51s
Dockle (container image)
ESLint (JavaScript lint)
39s
ESLint (JavaScript lint)
Flawfinder (C/C++ SAST)
24s
Flawfinder (C/C++ SAST)
GitHub SBOM (SPDX)
22s
GitHub SBOM (SPDX)
Gitleaks (Secrets)
29s
Gitleaks (Secrets)
golangci-lint (Go lint)
53s
golangci-lint (Go lint)
gosec (Go SAST)
50s
gosec (Go SAST)
govulncheck (Go SCA)
51s
govulncheck (Go SCA)
Grype (SCA)
2m 16s
Grype (SCA)
Grype image (OCI)
2m 14s
Grype image (OCI)
Hadolint (Dockerfile)
30s
Hadolint (Dockerfile)
KICS (IaC)
1m 33s
KICS (IaC)
mobsfscan (Mobile SAST)
33s
mobsfscan (Mobile SAST)
njsscan (Node SAST)
32s
njsscan (Node SAST)
Nosey Parker (secrets)
23s
Nosey Parker (secrets)
npm audit (Node SCA)
35s
npm audit (Node SCA)
OpenGrep (SAST)
1m 31s
OpenGrep (SAST)
OSV-Scanner (SCA)
34s
OSV-Scanner (SCA)
OWASP Dependency-Check (SCA)
3h 40m
OWASP Dependency-Check (SCA)
PMD (Java SAST)
21s
PMD (Java SAST)
Psalm (PHP SAST)
20s
Psalm (PHP SAST)
Regula (IaC policy)
26s
Regula (IaC policy)
Retire.js (JavaScript SCA)
43s
Retire.js (JavaScript SCA)
RuboCop (Ruby lint)
27s
RuboCop (Ruby lint)
Ruff (Python lint)
25s
Ruff (Python lint)
ScanCode Toolkit (license SBOM)
4m 54s
ScanCode Toolkit (license SBOM)
Semgrep (SAST)
30s
Semgrep (SAST)
ShellCheck (shell lint)
26s
ShellCheck (shell lint)
SwiftLint (Swift lint)
41s
SwiftLint (Swift lint)
Syft (CycloneDX SBOM)
33s
Syft (CycloneDX SBOM)
Syft image (CycloneDX SBOM)
29s
Syft image (CycloneDX SBOM)
Terrascan (Terraform)
38s
Terrascan (Terraform)
TFLint (Terraform)
18s
TFLint (Terraform)
tfsec (Terraform)
36s
tfsec (Terraform)
Trivy config (IaC/Dockerfile)
56s
Trivy config (IaC/Dockerfile)
Trivy (filesystem CDX + SARIF)
1m 11s
Trivy (filesystem CDX + SARIF)
Trivy image (OCI)
18s
Trivy image (OCI)
TruffleHog (secrets)
35s
TruffleHog (secrets)
zizmor (GitHub Actions SAST)
36s
zizmor (GitHub Actions SAST)
Publish to Vulnetix
1m 57s
Publish to Vulnetix
Fit to window
Zoom out
Zoom in

Annotations

6 errors, 56 warnings, and 21 notices
Brakeman (Ruby on Rails SAST)
Error: Could not convert version to a float at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11) at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37) at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3) at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11) at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40 at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3 at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12) at Module._compile (node:internal/modules/cjs/loader:1854:14) at Object..js (node:internal/modules/cjs/loader:1985:10) at Module.load (node:internal/modules/cjs/loader:1577:32)
PMD (Java SAST)
File pmd-report.sarif does not exist
CycloneDX Ruby SBOM
Error: Could not convert version to a float at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11) at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37) at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3) at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11) at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40 at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3 at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12) at Module._compile (node:internal/modules/cjs/loader:1854:14) at Object..js (node:internal/modules/cjs/loader:1985:10) at Module.load (node:internal/modules/cjs/loader:1577:32)
RuboCop (Ruby lint)
Error: Could not convert version to a float at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11) at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37) at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3) at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11) at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40 at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3 at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12) at Module._compile (node:internal/modules/cjs/loader:1854:14) at Object..js (node:internal/modules/cjs/loader:1985:10) at Module.load (node:internal/modules/cjs/loader:1577:32)
Semgrep (SAST)
Process completed with exit code 1.
Publish to Vulnetix
Process completed with exit code 1.
cdxgen (multi-ecosystem SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Checkov (IaC)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Checkov (IaC)
No files were found with the provided path: results.sarif. No artifacts will be uploaded.
Brakeman (Ruby on Rails SAST)
No files were found with the provided path: brakeman.sarif. No artifacts will be uploaded.
CycloneDX Rust SBOM
No files were found with the provided path: cyclonedx-rust.cdx.json. No artifacts will be uploaded.
Rust Clippy (SAST)
No files were found with the provided path: clippy.sarif. No artifacts will be uploaded.
Rust Clippy (SAST)
clippy produced no valid SARIF; dropping the artifact
Bandit (Python SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Cppcheck (C/C++ SAST)
No files were found with the provided path: cppcheck.sarif. No artifacts will be uploaded.
Cppcheck (C/C++ SAST)
cppcheck could not be installed on this runner; skipping
PMD (Java SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: pmd/pmd-github-action@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
PMD (Java SAST)
No files were found with the provided path: pmd-report.sarif. No artifacts will be uploaded.
Ruff (Python lint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
OSV-Scanner (SCA)
No files were found with the provided path: osv.sarif. No artifacts will be uploaded.
OSV-Scanner (SCA)
No lockfiles found. Please use the --allow-no-lockfiles flag to suppress this warning.
npm audit (Node SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
npm audit (Node SCA)
No files were found with the provided path: npm-audit.sarif. No artifacts will be uploaded.
Grype (SCA)
Failed minimum severity level. Found vulnerabilities with level 'medium' or higher
Retire.js (JavaScript SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
govulncheck (Go SCA)
No files were found with the provided path: govulncheck.sarif. No artifacts will be uploaded.
govulncheck (Go SCA)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
CycloneDX Ruby SBOM
No files were found with the provided path: cyclonedx-ruby.cdx.json. No artifacts will be uploaded.
njsscan (Node SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
detect-secrets (secrets)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Flawfinder (C/C++ SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CycloneDX Maven (SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CycloneDX Maven (SBOM)
Error: Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.
CycloneDX Maven (SBOM)
No files were found with the provided path: cyclonedx-maven.cdx.json. No artifacts will be uploaded.
CycloneDX Maven (SBOM)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
CycloneDX Go SBOM
No files were found with the provided path: cyclonedx-go.cdx.json. No artifacts will be uploaded.
CycloneDX Go SBOM
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
golangci-lint (Go lint)
No files were found with the provided path: golangci-lint.sarif. No artifacts will be uploaded.
golangci-lint (Go lint)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
Grype image (OCI)
Failed minimum severity level. Found vulnerabilities with level 'medium' or higher
CycloneDX npm SBOM
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CycloneDX npm SBOM
No files were found with the provided path: cyclonedx-node.cdx.json. No artifacts will be uploaded.
detekt (Kotlin SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
detekt (Kotlin SAST)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
zizmor (GitHub Actions SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
ESLint (JavaScript lint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
ESLint (JavaScript lint)
No files were found with the provided path: eslint.sarif. No artifacts will be uploaded.
gosec (Go SAST)
No files were found with the provided path: gosec.sarif. No artifacts will be uploaded.
gosec (Go SAST)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
TFLint (Terraform)
No files were found with the provided path: tflint.sarif. No artifacts will be uploaded.
TFLint (Terraform)
tflint could not be installed on this runner; skipping
CycloneDX PHP SBOM
No files were found with the provided path: cyclonedx-php.cdx.json. No artifacts will be uploaded.
Trivy image (OCI)
No files were found with the provided path: trivy-image.sarif. No artifacts will be uploaded.
Psalm (PHP SAST)
No files were found with the provided path: psalm.sarif. No artifacts will be uploaded.
mobsfscan (Mobile SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Dockle (container image)
No files were found with the provided path: dockle.sarif. No artifacts will be uploaded.
Dockle (container image)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
ScanCode Toolkit (license SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Semgrep (SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Semgrep (SAST)
No files were found with the provided path: semgrep.sarif. No artifacts will be uploaded.
OWASP Dependency-Check (SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
OWASP Dependency-Check (SCA)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
Brakeman (Ruby on Rails SAST)
no Rails app detected; skipping Brakeman
CycloneDX Rust SBOM
no Cargo project found; skipping CycloneDX Rust
npm audit (Node SCA)
no package-lock.json found; skipping npm audit
govulncheck (Go SCA)
no go.mod found; skipping govulncheck
CycloneDX Ruby SBOM
no Gemfile.lock found; skipping CycloneDX Ruby
CycloneDX Maven (SBOM)
no pom.xml found; skipping CycloneDX Maven
CycloneDX Go SBOM
no go.mod found; skipping CycloneDX Go
golangci-lint (Go lint)
no go.mod found; skipping golangci-lint
Grype image (OCI)
no Dockerfile or Containerfile found; skipping
CycloneDX npm SBOM
no package-lock.json found; skipping CycloneDX npm
ESLint (JavaScript lint)
no package.json found; skipping ESLint
gosec (Go SAST)
no go.mod found; skipping gosec
CycloneDX PHP SBOM
no composer.lock found; skipping CycloneDX PHP
Trivy image (OCI)
no image was built; skipping Trivy image scan
Trivy image (OCI)
no Dockerfile or Containerfile found; skipping
CycloneDX PHP SBOM
passwordless sudo is unavailable on this runner; using the PHP already installed
Psalm (PHP SAST)
no composer.json found; skipping Psalm
Psalm (PHP SAST)
passwordless sudo is unavailable on this runner; using the PHP already installed
Syft image (CycloneDX SBOM)
no Dockerfile or Containerfile found; skipping
Dockle (container image)
no Dockerfile or Containerfile found; skipping Dockle
Terrascan (Terraform)
terrascan found no IaC files

Artifacts

Produced during runtime
Name Size Digest
bandit Expired
25.1 KB
sha256:acecd09e2e155a04cce0226b6a728b6339099622ce703a31037fba50b0b78efa
bearer Expired
140 KB
sha256:04a035995b505199cc49669a565be63afe10a743758717d554998bf8eda9146a
cdxgen Expired
4.48 KB
sha256:91053ea8fe529bafee98110f499bea09d83d7e4a84444bc4d728a5c2a1817f8f
dependency-check Expired
27.8 KB
sha256:945da8ea1818718b9abc2994b3d5beb75dc104b8e6901e05afa3c8e20190e0c7
detect-secrets Expired
3.3 KB
sha256:468401dca4ca16a793ee9743248b90b24e69c35999e93f4577aa9ec875e09ec0
detekt Expired
13 KB
sha256:b21476d211369a93059dd6155bd9e62eeab0cecfaa5278cfb0457c507dae17ab
flawfinder Expired
3.08 KB
sha256:329cfea8a45f24c478d28e765ef49ab8891cbc34c97e7c6ee0f8489fb0f446bd
github-sbom Expired
2.48 KB
sha256:735078295506e205aad2188de6b3d4626fb74564a867215fe6545a85765c42e0
gitleaks Expired
8.26 KB
sha256:c2e0e2c8e8a97c5c127c7017a7cbb8a35dcfca258e24ffc727c62f7af1dd9025
grype Expired
5.81 KB
sha256:45de42d0a08bc1b1c09a82ae3a7daee56ceff8cbebbaa69545b79176380ef58a
grype-image Expired
5.82 KB
sha256:f23dc4ec26c853d8c8f64e482f6fd9dda8497723670a963730707e2d8947ec65
hadolint Expired
145 Bytes
sha256:99a2f7519917deb4ce139f2e7b14351348f4c95328498bf6505d258ad200a248
kics Expired
22.3 KB
sha256:f76e6b32798d808bed4372b14be18e403733266e149dfceae177d552fb4c7c73
mobsfscan Expired
3.44 KB
sha256:6de4db5b32999c1a0c26eea7ba3aaba6e329124605c770f3446358c874f8603c
njsscan Expired
867 Bytes
sha256:36500bdc871fda4457a9b1fd49d4506c6eac849b77247e3685ddc6e3291472a9
noseyparker Expired
19.5 KB
sha256:38c017aca78924b5e987d6fd897d60c0dbf7ef538ea664cd31d871b3b01fc797
opengrep Expired
262 KB
sha256:9dd4dcb9e55bf825d01caf28bc8eedba70bde003abdf370c07d716103104acc2
regula Expired
6.98 KB
sha256:11e2e0d0e3999853aca392ef17fe77cb27d31fdad3c741a439acc2939ebddde9
retirejs Expired
464 Bytes
sha256:8e9c927ad1693db0c3e570bd38ce45755430434fce5baac6703c0ad36ea70d1c
rubocop Expired
313 Bytes
sha256:4554d6274d3278965dd6570621d5629b56a5ea5b266460afde715420392b2fff
ruff Expired
20.2 KB
sha256:7656aa81f6a2d7e6d28839c120b9bf6f3058c16edb32718068e051cebc680760
sbom.cdx.json Expired
7.06 KB
sha256:480e7d2da5705a5c3888a117852a88d091a8e19d1d3f4a5c88ca1dc7dc977ce5
scancode Expired
5.48 KB
sha256:9be4a3ab647f1f13e910f1585c42438799e005d6289425009a7ccca80663b99a
shellcheck Expired
927 Bytes
sha256:34edfb9ee6eebb1d5acf466e0fa7dfe303a7cce85c9dad196e06fcbc9b594a1f
swiftlint Expired
14.6 KB
sha256:8746fca8edfc83cffbcc53c0f44359cbb776e6887d40b631462a4855a9193f80
syft Expired
7.06 KB
sha256:480e7d2da5705a5c3888a117852a88d091a8e19d1d3f4a5c88ca1dc7dc977ce5
syft-image Expired
7.07 KB
sha256:133ef4c6da049e6a87decbbea9d23e320c92f2578d27aeb82d9222ab0e29d91f
terrascan Expired
7.53 KB
sha256:11b03edb50774e7520d737fe6cdce0fd1e776523c8d9a7a3b5c9c9f76c503ea5
tfsec Expired
1.94 KB
sha256:f38df85c79ad6b8b145e5d940d0519d6ccfef5395cb87179c574232380a57937
trivy-config Expired
7.71 KB
sha256:37126e04fd3cb9580551091d532416bd618a813ad30c69dd6b1aea1474796bcd
trivy-fs Expired
21.2 KB
sha256:16097f4a903691ddc9d18e6662bf4120803e005bb7d2f32391823fbdc8e47af9
trufflehog Expired
996 Bytes
sha256:324d0aff6f1ea84bfefd7ba55d1405e1c009a38a28454b8dde29685ee6f2ccb1
zizmor Expired
6.76 KB
sha256:6b50743d12dbcd69ff8953017190656d261503cf23af6d93653a437f06fa4298