Third-Party Scanners #6
vulnetix-scanners.yml
on: workflow_dispatch
Bandit (Python SAST)
30s
Bearer (SAST)
1m 56s
Brakeman (Ruby on Rails SAST)
19s
cdxgen (multi-ecosystem SBOM)
1m 22s
Checkov (IaC)
2m 17s
Rust Clippy (SAST)
17s
Cppcheck (C/C++ SAST)
18s
CycloneDX Go SBOM
53s
CycloneDX Maven (SBOM)
32s
CycloneDX npm SBOM
37s
CycloneDX PHP SBOM
17s
CycloneDX Ruby SBOM
19s
CycloneDX Rust SBOM
17s
detect-secrets (secrets)
40s
detekt (Kotlin SAST)
39s
Dockle (container image)
55s
ESLint (JavaScript lint)
36s
Flawfinder (C/C++ SAST)
25s
GitHub SBOM (SPDX)
20s
Gitleaks (Secrets)
30s
golangci-lint (Go lint)
52s
gosec (Go SAST)
52s
govulncheck (Go SCA)
50s
Grype (SCA)
2m 15s
Grype image (OCI)
2m 14s
Hadolint (Dockerfile)
27s
KICS (IaC)
1m 30s
mobsfscan (Mobile SAST)
34s
njsscan (Node SAST)
33s
Nosey Parker (secrets)
22s
npm audit (Node SCA)
34s
OpenGrep (SAST)
1m 30s
OSV-Scanner (SCA)
37s
OWASP Dependency-Check (SCA)
2m 55s
PMD (Java SAST)
24s
Psalm (PHP SAST)
19s
Regula (IaC policy)
26s
Retire.js (JavaScript SCA)
43s
RuboCop (Ruby lint)
24s
Ruff (Python lint)
26s
ScanCode Toolkit (license SBOM)
5m 10s
Semgrep (SAST)
31s
ShellCheck (shell lint)
26s
SwiftLint (Swift lint)
40s
Syft (CycloneDX SBOM)
30s
Syft image (CycloneDX SBOM)
31s
Terrascan (Terraform)
40s
TFLint (Terraform)
18s
tfsec (Terraform)
33s
Trivy config (IaC/Dockerfile)
50s
Trivy (filesystem CDX + SARIF)
1m 12s
Trivy image (OCI)
18s
TruffleHog (secrets)
35s
zizmor (GitHub Actions SAST)
35s
Publish to Vulnetix
2m 27s
Annotations
5 errors, 56 warnings, and 21 notices
|
Brakeman (Ruby on Rails SAST)
Error: Could not convert version to a float
at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11)
at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37)
at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3)
at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11)
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3
at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12)
at Module._compile (node:internal/modules/cjs/loader:1854:14)
at Object..js (node:internal/modules/cjs/loader:1985:10)
at Module.load (node:internal/modules/cjs/loader:1577:32)
|
|
CycloneDX Ruby SBOM
Error: Could not convert version to a float
at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11)
at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37)
at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3)
at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11)
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3
at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12)
at Module._compile (node:internal/modules/cjs/loader:1854:14)
at Object..js (node:internal/modules/cjs/loader:1985:10)
at Module.load (node:internal/modules/cjs/loader:1577:32)
|
|
RuboCop (Ruby lint)
Error: Could not convert version to a float
at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11)
at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37)
at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3)
at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11)
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40
at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3
at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12)
at Module._compile (node:internal/modules/cjs/loader:1854:14)
at Object..js (node:internal/modules/cjs/loader:1985:10)
at Module.load (node:internal/modules/cjs/loader:1577:32)
|
|
PMD (Java SAST)
File pmd-report.sarif does not exist
|
|
Semgrep (SAST)
Process completed with exit code 1.
|
|
Rust Clippy (SAST)
No files were found with the provided path: clippy.sarif. No artifacts will be uploaded.
|
|
Rust Clippy (SAST)
clippy produced no valid SARIF; dropping the artifact
|
|
Brakeman (Ruby on Rails SAST)
No files were found with the provided path: brakeman.sarif. No artifacts will be uploaded.
|
|
Cppcheck (C/C++ SAST)
No files were found with the provided path: cppcheck.sarif. No artifacts will be uploaded.
|
|
Cppcheck (C/C++ SAST)
cppcheck could not be installed on this runner; skipping
|
|
CycloneDX Ruby SBOM
No files were found with the provided path: cyclonedx-ruby.cdx.json. No artifacts will be uploaded.
|
|
Bandit (Python SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CycloneDX Maven (SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CycloneDX Maven (SBOM)
Error: Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.
|
|
CycloneDX Maven (SBOM)
No files were found with the provided path: cyclonedx-maven.cdx.json. No artifacts will be uploaded.
|
|
CycloneDX Maven (SBOM)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
|
|
mobsfscan (Mobile SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
OSV-Scanner (SCA)
No files were found with the provided path: osv.sarif. No artifacts will be uploaded.
|
|
OSV-Scanner (SCA)
No lockfiles found. Please use the --allow-no-lockfiles flag to suppress this warning.
|
|
detekt (Kotlin SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
detekt (Kotlin SAST)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
|
|
Retire.js (JavaScript SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CycloneDX Go SBOM
No files were found with the provided path: cyclonedx-go.cdx.json. No artifacts will be uploaded.
|
|
CycloneDX Go SBOM
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
cdxgen (multi-ecosystem SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Checkov (IaC)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Checkov (IaC)
No files were found with the provided path: results.sarif. No artifacts will be uploaded.
|
|
ScanCode Toolkit (license SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CycloneDX PHP SBOM
No files were found with the provided path: cyclonedx-php.cdx.json. No artifacts will be uploaded.
|
|
CycloneDX Rust SBOM
No files were found with the provided path: cyclonedx-rust.cdx.json. No artifacts will be uploaded.
|
|
TFLint (Terraform)
No files were found with the provided path: tflint.sarif. No artifacts will be uploaded.
|
|
TFLint (Terraform)
tflint could not be installed on this runner; skipping
|
|
Psalm (PHP SAST)
No files were found with the provided path: psalm.sarif. No artifacts will be uploaded.
|
|
Trivy image (OCI)
No files were found with the provided path: trivy-image.sarif. No artifacts will be uploaded.
|
|
PMD (Java SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: pmd/pmd-github-action@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
PMD (Java SAST)
No files were found with the provided path: pmd-report.sarif. No artifacts will be uploaded.
|
|
Flawfinder (C/C++ SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
zizmor (GitHub Actions SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
npm audit (Node SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
npm audit (Node SCA)
No files were found with the provided path: npm-audit.sarif. No artifacts will be uploaded.
|
|
ESLint (JavaScript lint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
ESLint (JavaScript lint)
No files were found with the provided path: eslint.sarif. No artifacts will be uploaded.
|
|
detect-secrets (secrets)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
gosec (Go SAST)
No files were found with the provided path: gosec.sarif. No artifacts will be uploaded.
|
|
gosec (Go SAST)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
Dockle (container image)
No files were found with the provided path: dockle.sarif. No artifacts will be uploaded.
|
|
Dockle (container image)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
Grype image (OCI)
Failed minimum severity level. Found vulnerabilities with level 'medium' or higher
|
|
Grype (SCA)
Failed minimum severity level. Found vulnerabilities with level 'medium' or higher
|
|
OWASP Dependency-Check (SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
OWASP Dependency-Check (SCA)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
|
|
Semgrep (SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Semgrep (SAST)
No files were found with the provided path: semgrep.sarif. No artifacts will be uploaded.
|
|
njsscan (Node SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CycloneDX npm SBOM
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CycloneDX npm SBOM
No files were found with the provided path: cyclonedx-node.cdx.json. No artifacts will be uploaded.
|
|
golangci-lint (Go lint)
No files were found with the provided path: golangci-lint.sarif. No artifacts will be uploaded.
|
|
golangci-lint (Go lint)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
Ruff (Python lint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
govulncheck (Go SCA)
No files were found with the provided path: govulncheck.sarif. No artifacts will be uploaded.
|
|
govulncheck (Go SCA)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
|
|
Brakeman (Ruby on Rails SAST)
no Rails app detected; skipping Brakeman
|
|
CycloneDX Ruby SBOM
no Gemfile.lock found; skipping CycloneDX Ruby
|
|
CycloneDX Maven (SBOM)
no pom.xml found; skipping CycloneDX Maven
|
|
Terrascan (Terraform)
terrascan found no IaC files
|
|
CycloneDX Go SBOM
no go.mod found; skipping CycloneDX Go
|
|
CycloneDX PHP SBOM
no composer.lock found; skipping CycloneDX PHP
|
|
CycloneDX PHP SBOM
passwordless sudo is unavailable on this runner; using the PHP already installed
|
|
CycloneDX Rust SBOM
no Cargo project found; skipping CycloneDX Rust
|
|
Psalm (PHP SAST)
no composer.json found; skipping Psalm
|
|
Psalm (PHP SAST)
passwordless sudo is unavailable on this runner; using the PHP already installed
|
|
Trivy image (OCI)
no image was built; skipping Trivy image scan
|
|
Trivy image (OCI)
no Dockerfile or Containerfile found; skipping
|
|
Syft image (CycloneDX SBOM)
no Dockerfile or Containerfile found; skipping
|
|
npm audit (Node SCA)
no package-lock.json found; skipping npm audit
|
|
ESLint (JavaScript lint)
no package.json found; skipping ESLint
|
|
gosec (Go SAST)
no go.mod found; skipping gosec
|
|
Dockle (container image)
no Dockerfile or Containerfile found; skipping Dockle
|
|
Grype image (OCI)
no Dockerfile or Containerfile found; skipping
|
|
CycloneDX npm SBOM
no package-lock.json found; skipping CycloneDX npm
|
|
golangci-lint (Go lint)
no go.mod found; skipping golangci-lint
|
|
govulncheck (Go SCA)
no go.mod found; skipping govulncheck
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
bandit
Expired
|
25.1 KB |
sha256:c5faea8e58696f58d2b0b2aa8c44fbf486ac137235ffdac365851bd530ab6a5c
|
|
|
bearer
Expired
|
140 KB |
sha256:99afd09b9f7d00ecfcda171c1dd8dc1197b55dda106e9659b60436885d4d85a6
|
|
|
cdxgen
Expired
|
4.41 KB |
sha256:58f94f6112f50b90601132c47d360dbb32eea91009c70d011be8e8c59c2b6aac
|
|
|
dependency-check
Expired
|
27.8 KB |
sha256:8c4e658d11b58a04c208bf8eb0e9bd39e16f22bf4f13233ee980aa11f0b23a5c
|
|
|
detect-secrets
Expired
|
3.3 KB |
sha256:97fbc94ac83c73168dabee28c1fe2f8b1ec298f41e7bde6104d5c17d247e8eb8
|
|
|
detekt
Expired
|
13 KB |
sha256:4bbbf3cf0c2321705eacc7848df795e5743547b96305a4c83dfcb0fa45f8496b
|
|
|
flawfinder
Expired
|
3.08 KB |
sha256:5a84087b704f15bf21a637e51d555907c7916e634587d628768964ecb23ffe0c
|
|
|
github-sbom
Expired
|
2.42 KB |
sha256:a980000788e6692787042bd27021ad22f1be56ac42f833a8431eb61a6b4e16ed
|
|
|
gitleaks
Expired
|
8.27 KB |
sha256:c8e3f5fafecacc682d495f91e4ed30dc4f2d4bd59caec4e60a420e1fa3179aff
|
|
|
grype
Expired
|
5.81 KB |
sha256:e375ac864d8c36d6b81fd5ebd7e63fc5cf67d294289ec4a96180de50d32eac0f
|
|
|
grype-image
Expired
|
5.82 KB |
sha256:ee6b2e247e528f06ee39bfcac1096b280144273dd7488bf290dc19e5748a1317
|
|
|
hadolint
Expired
|
635 Bytes |
sha256:d76b03257f73f5269350b70a930a9866602fe912ecfc7593859485cb524a885c
|
|
|
kics
Expired
|
22.2 KB |
sha256:8f9eb68958361fb20d0e435da7b043018074389742f3917da561353a5610fb6b
|
|
|
mobsfscan
Expired
|
3.44 KB |
sha256:ce35257fe76f836b176d4c7266489edb5c2247f701616cfb6f2a2d1113ee0d1d
|
|
|
njsscan
Expired
|
866 Bytes |
sha256:3f3928ba21554df631a4493959aaf7cd49df5d140925f9fc60b16bab918777a8
|
|
|
noseyparker
Expired
|
19.8 KB |
sha256:fcc5a230625c9164d0665949a81de578d6128260d645e055c8150926ceef8db7
|
|
|
opengrep
Expired
|
262 KB |
sha256:9437af84fa2e4b570e354e6e849b598f6be25610b0a0b165dca9b032fdce4dac
|
|
|
regula
Expired
|
6.97 KB |
sha256:0f878a708146abb641fbab1b3484901b3bb158653ae97a1544ee8a08fd62cff0
|
|
|
retirejs
Expired
|
463 Bytes |
sha256:903f572cb9b5fda4c3e81c5a7e666659937e7b2f7c96e8845c82ff057429130d
|
|
|
rubocop
Expired
|
313 Bytes |
sha256:16b43edfe57e5ef3a0e360888948d192ee1ff0a02aff8ea2b78a4352ec8030e0
|
|
|
ruff
Expired
|
20.2 KB |
sha256:888affd30431773890e655d7c0edbd45854e9bcce6a9123a835fcb10f1d3d2bf
|
|
|
sbom.cdx.json
Expired
|
6.98 KB |
sha256:00286d2e920bcc54facf78772b9e72ebdd31b4d34e8e3f6a4e33881aeffa6872
|
|
|
scancode
Expired
|
5.48 KB |
sha256:234cd42ecf1c70465873e4fa82b0a95b3e6667179b504a3471dfd1b397d42e1d
|
|
|
shellcheck
Expired
|
927 Bytes |
sha256:10fcc994e30826367c6d46d6e1e8d128d6760d069f29d5ce32b9e5347c5e16cb
|
|
|
swiftlint
Expired
|
14.6 KB |
sha256:3356c048db57c164d05bc8a68aa9d2e035a7ce11f8ab735b69ec8ed7bce4905c
|
|
|
syft
Expired
|
6.98 KB |
sha256:00286d2e920bcc54facf78772b9e72ebdd31b4d34e8e3f6a4e33881aeffa6872
|
|
|
syft-image
Expired
|
6.99 KB |
sha256:fe9a8425bc80941b92740b58d4fc2b7a1c2aad87b70c5e5acd14565258d36d57
|
|
|
terrascan
Expired
|
7.52 KB |
sha256:43d48b219b66d61ea9fd2561b83c7dbed50cfa93337e15771afb83fd26cbfdd4
|
|
|
tfsec
Expired
|
1.94 KB |
sha256:9d5669e828bc25b887e41fbf5555f084b5be59199c0dc52aa126ce4a79a20955
|
|
|
trivy-config
Expired
|
7.71 KB |
sha256:8d717f63a6b9e99acde73c36f7752f56389d5db671fa5f6ba57b3303ec22d8eb
|
|
|
trivy-fs
Expired
|
21.3 KB |
sha256:a94bfaffc3966f35d2875fb19e938451e02200cf565d7d59419d0721f124e433
|
|
|
trufflehog
Expired
|
996 Bytes |
sha256:29b27c01b757ace686340e44adb8ee1fbcc72cda8abb58f436bd22301499ff23
|
|
|
zizmor
Expired
|
6.67 KB |
sha256:1a0f9ae0fca39ff3273a6ada2830c791fd4e23b2275f869354a4c4debc13e630
|
|