Skip to content

Third-Party Scanners #6

Third-Party Scanners

Third-Party Scanners #6

Manually triggered August 26, 2026 13:47
Status Success
Total duration 1h 2m 50s
Artifacts 33

vulnetix-scanners.yml

on: workflow_dispatch
Bandit (Python SAST)
30s
Bandit (Python SAST)
Bearer (SAST)
1m 56s
Bearer (SAST)
Brakeman (Ruby on Rails SAST)
19s
Brakeman (Ruby on Rails SAST)
cdxgen (multi-ecosystem SBOM)
1m 22s
cdxgen (multi-ecosystem SBOM)
Checkov (IaC)
2m 17s
Checkov (IaC)
Rust Clippy (SAST)
17s
Rust Clippy (SAST)
Cppcheck (C/C++ SAST)
18s
Cppcheck (C/C++ SAST)
CycloneDX Go SBOM
53s
CycloneDX Go SBOM
CycloneDX Maven (SBOM)
32s
CycloneDX Maven (SBOM)
CycloneDX npm SBOM
37s
CycloneDX npm SBOM
CycloneDX PHP SBOM
17s
CycloneDX PHP SBOM
CycloneDX Ruby SBOM
19s
CycloneDX Ruby SBOM
CycloneDX Rust SBOM
17s
CycloneDX Rust SBOM
detect-secrets (secrets)
40s
detect-secrets (secrets)
detekt (Kotlin SAST)
39s
detekt (Kotlin SAST)
Dockle (container image)
55s
Dockle (container image)
ESLint (JavaScript lint)
36s
ESLint (JavaScript lint)
Flawfinder (C/C++ SAST)
25s
Flawfinder (C/C++ SAST)
GitHub SBOM (SPDX)
20s
GitHub SBOM (SPDX)
Gitleaks (Secrets)
30s
Gitleaks (Secrets)
golangci-lint (Go lint)
52s
golangci-lint (Go lint)
gosec (Go SAST)
52s
gosec (Go SAST)
govulncheck (Go SCA)
50s
govulncheck (Go SCA)
Grype (SCA)
2m 15s
Grype (SCA)
Grype image (OCI)
2m 14s
Grype image (OCI)
Hadolint (Dockerfile)
27s
Hadolint (Dockerfile)
KICS (IaC)
1m 30s
KICS (IaC)
mobsfscan (Mobile SAST)
34s
mobsfscan (Mobile SAST)
njsscan (Node SAST)
33s
njsscan (Node SAST)
Nosey Parker (secrets)
22s
Nosey Parker (secrets)
npm audit (Node SCA)
34s
npm audit (Node SCA)
OpenGrep (SAST)
1m 30s
OpenGrep (SAST)
OSV-Scanner (SCA)
37s
OSV-Scanner (SCA)
OWASP Dependency-Check (SCA)
2m 55s
OWASP Dependency-Check (SCA)
PMD (Java SAST)
24s
PMD (Java SAST)
Psalm (PHP SAST)
19s
Psalm (PHP SAST)
Regula (IaC policy)
26s
Regula (IaC policy)
Retire.js (JavaScript SCA)
43s
Retire.js (JavaScript SCA)
RuboCop (Ruby lint)
24s
RuboCop (Ruby lint)
Ruff (Python lint)
26s
Ruff (Python lint)
ScanCode Toolkit (license SBOM)
5m 10s
ScanCode Toolkit (license SBOM)
Semgrep (SAST)
31s
Semgrep (SAST)
ShellCheck (shell lint)
26s
ShellCheck (shell lint)
SwiftLint (Swift lint)
40s
SwiftLint (Swift lint)
Syft (CycloneDX SBOM)
30s
Syft (CycloneDX SBOM)
Syft image (CycloneDX SBOM)
31s
Syft image (CycloneDX SBOM)
Terrascan (Terraform)
40s
Terrascan (Terraform)
TFLint (Terraform)
18s
TFLint (Terraform)
tfsec (Terraform)
33s
tfsec (Terraform)
Trivy config (IaC/Dockerfile)
50s
Trivy config (IaC/Dockerfile)
Trivy (filesystem CDX + SARIF)
1m 12s
Trivy (filesystem CDX + SARIF)
Trivy image (OCI)
18s
Trivy image (OCI)
TruffleHog (secrets)
35s
TruffleHog (secrets)
zizmor (GitHub Actions SAST)
35s
zizmor (GitHub Actions SAST)
Publish to Vulnetix
2m 27s
Publish to Vulnetix
Fit to window
Zoom out
Zoom in

Annotations

5 errors, 56 warnings, and 21 notices
Brakeman (Ruby on Rails SAST)
Error: Could not convert version to a float at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11) at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37) at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3) at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11) at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40 at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3 at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12) at Module._compile (node:internal/modules/cjs/loader:1854:14) at Object..js (node:internal/modules/cjs/loader:1985:10) at Module.load (node:internal/modules/cjs/loader:1577:32)
CycloneDX Ruby SBOM
Error: Could not convert version to a float at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11) at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37) at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3) at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11) at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40 at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3 at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12) at Module._compile (node:internal/modules/cjs/loader:1854:14) at Object..js (node:internal/modules/cjs/loader:1985:10) at Module.load (node:internal/modules/cjs/loader:1577:32)
RuboCop (Ruby lint)
Error: Could not convert version to a float at Module.floatVersion (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:506:11) at createGemRC (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92700:37) at setupRuby (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92563:3) at run (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92518:11) at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92722:40 at /home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92724:3 at Object.<anonymous> (/home/runner/_work/_actions/ruby/setup-ruby/v1/dist/index.js:92727:12) at Module._compile (node:internal/modules/cjs/loader:1854:14) at Object..js (node:internal/modules/cjs/loader:1985:10) at Module.load (node:internal/modules/cjs/loader:1577:32)
PMD (Java SAST)
File pmd-report.sarif does not exist
Semgrep (SAST)
Process completed with exit code 1.
Rust Clippy (SAST)
No files were found with the provided path: clippy.sarif. No artifacts will be uploaded.
Rust Clippy (SAST)
clippy produced no valid SARIF; dropping the artifact
Brakeman (Ruby on Rails SAST)
No files were found with the provided path: brakeman.sarif. No artifacts will be uploaded.
Cppcheck (C/C++ SAST)
No files were found with the provided path: cppcheck.sarif. No artifacts will be uploaded.
Cppcheck (C/C++ SAST)
cppcheck could not be installed on this runner; skipping
CycloneDX Ruby SBOM
No files were found with the provided path: cyclonedx-ruby.cdx.json. No artifacts will be uploaded.
Bandit (Python SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CycloneDX Maven (SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CycloneDX Maven (SBOM)
Error: Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.
CycloneDX Maven (SBOM)
No files were found with the provided path: cyclonedx-maven.cdx.json. No artifacts will be uploaded.
CycloneDX Maven (SBOM)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
mobsfscan (Mobile SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
OSV-Scanner (SCA)
No files were found with the provided path: osv.sarif. No artifacts will be uploaded.
OSV-Scanner (SCA)
No lockfiles found. Please use the --allow-no-lockfiles flag to suppress this warning.
detekt (Kotlin SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
detekt (Kotlin SAST)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
Retire.js (JavaScript SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CycloneDX Go SBOM
No files were found with the provided path: cyclonedx-go.cdx.json. No artifacts will be uploaded.
CycloneDX Go SBOM
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
cdxgen (multi-ecosystem SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Checkov (IaC)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Checkov (IaC)
No files were found with the provided path: results.sarif. No artifacts will be uploaded.
ScanCode Toolkit (license SBOM)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CycloneDX PHP SBOM
No files were found with the provided path: cyclonedx-php.cdx.json. No artifacts will be uploaded.
CycloneDX Rust SBOM
No files were found with the provided path: cyclonedx-rust.cdx.json. No artifacts will be uploaded.
TFLint (Terraform)
No files were found with the provided path: tflint.sarif. No artifacts will be uploaded.
TFLint (Terraform)
tflint could not be installed on this runner; skipping
Psalm (PHP SAST)
No files were found with the provided path: psalm.sarif. No artifacts will be uploaded.
Trivy image (OCI)
No files were found with the provided path: trivy-image.sarif. No artifacts will be uploaded.
PMD (Java SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: pmd/pmd-github-action@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
PMD (Java SAST)
No files were found with the provided path: pmd-report.sarif. No artifacts will be uploaded.
Flawfinder (C/C++ SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
zizmor (GitHub Actions SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
npm audit (Node SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
npm audit (Node SCA)
No files were found with the provided path: npm-audit.sarif. No artifacts will be uploaded.
ESLint (JavaScript lint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
ESLint (JavaScript lint)
No files were found with the provided path: eslint.sarif. No artifacts will be uploaded.
detect-secrets (secrets)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
gosec (Go SAST)
No files were found with the provided path: gosec.sarif. No artifacts will be uploaded.
gosec (Go SAST)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
Dockle (container image)
No files were found with the provided path: dockle.sarif. No artifacts will be uploaded.
Dockle (container image)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
Grype image (OCI)
Failed minimum severity level. Found vulnerabilities with level 'medium' or higher
Grype (SCA)
Failed minimum severity level. Found vulnerabilities with level 'medium' or higher
OWASP Dependency-Check (SCA)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/setup-java@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
OWASP Dependency-Check (SCA)
setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.
Semgrep (SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Semgrep (SAST)
No files were found with the provided path: semgrep.sarif. No artifacts will be uploaded.
njsscan (Node SAST)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CycloneDX npm SBOM
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CycloneDX npm SBOM
No files were found with the provided path: cyclonedx-node.cdx.json. No artifacts will be uploaded.
golangci-lint (Go lint)
No files were found with the provided path: golangci-lint.sarif. No artifacts will be uploaded.
golangci-lint (Go lint)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
Ruff (Python lint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: astral-sh/setup-uv@v6. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
govulncheck (Go SCA)
No files were found with the provided path: govulncheck.sarif. No artifacts will be uploaded.
govulncheck (Go SCA)
Restore cache failed: Dependencies file is not found in /home/runner/_work/sast-rule-evals/sast-rule-evals. Supported file pattern: go.mod
Brakeman (Ruby on Rails SAST)
no Rails app detected; skipping Brakeman
CycloneDX Ruby SBOM
no Gemfile.lock found; skipping CycloneDX Ruby
CycloneDX Maven (SBOM)
no pom.xml found; skipping CycloneDX Maven
Terrascan (Terraform)
terrascan found no IaC files
CycloneDX Go SBOM
no go.mod found; skipping CycloneDX Go
CycloneDX PHP SBOM
no composer.lock found; skipping CycloneDX PHP
CycloneDX PHP SBOM
passwordless sudo is unavailable on this runner; using the PHP already installed
CycloneDX Rust SBOM
no Cargo project found; skipping CycloneDX Rust
Psalm (PHP SAST)
no composer.json found; skipping Psalm
Psalm (PHP SAST)
passwordless sudo is unavailable on this runner; using the PHP already installed
Trivy image (OCI)
no image was built; skipping Trivy image scan
Trivy image (OCI)
no Dockerfile or Containerfile found; skipping
Syft image (CycloneDX SBOM)
no Dockerfile or Containerfile found; skipping
npm audit (Node SCA)
no package-lock.json found; skipping npm audit
ESLint (JavaScript lint)
no package.json found; skipping ESLint
gosec (Go SAST)
no go.mod found; skipping gosec
Dockle (container image)
no Dockerfile or Containerfile found; skipping Dockle
Grype image (OCI)
no Dockerfile or Containerfile found; skipping
CycloneDX npm SBOM
no package-lock.json found; skipping CycloneDX npm
golangci-lint (Go lint)
no go.mod found; skipping golangci-lint
govulncheck (Go SCA)
no go.mod found; skipping govulncheck

Artifacts

Produced during runtime
Name Size Digest
bandit Expired
25.1 KB
sha256:c5faea8e58696f58d2b0b2aa8c44fbf486ac137235ffdac365851bd530ab6a5c
bearer Expired
140 KB
sha256:99afd09b9f7d00ecfcda171c1dd8dc1197b55dda106e9659b60436885d4d85a6
cdxgen Expired
4.41 KB
sha256:58f94f6112f50b90601132c47d360dbb32eea91009c70d011be8e8c59c2b6aac
dependency-check Expired
27.8 KB
sha256:8c4e658d11b58a04c208bf8eb0e9bd39e16f22bf4f13233ee980aa11f0b23a5c
detect-secrets Expired
3.3 KB
sha256:97fbc94ac83c73168dabee28c1fe2f8b1ec298f41e7bde6104d5c17d247e8eb8
detekt Expired
13 KB
sha256:4bbbf3cf0c2321705eacc7848df795e5743547b96305a4c83dfcb0fa45f8496b
flawfinder Expired
3.08 KB
sha256:5a84087b704f15bf21a637e51d555907c7916e634587d628768964ecb23ffe0c
github-sbom Expired
2.42 KB
sha256:a980000788e6692787042bd27021ad22f1be56ac42f833a8431eb61a6b4e16ed
gitleaks Expired
8.27 KB
sha256:c8e3f5fafecacc682d495f91e4ed30dc4f2d4bd59caec4e60a420e1fa3179aff
grype Expired
5.81 KB
sha256:e375ac864d8c36d6b81fd5ebd7e63fc5cf67d294289ec4a96180de50d32eac0f
grype-image Expired
5.82 KB
sha256:ee6b2e247e528f06ee39bfcac1096b280144273dd7488bf290dc19e5748a1317
hadolint Expired
635 Bytes
sha256:d76b03257f73f5269350b70a930a9866602fe912ecfc7593859485cb524a885c
kics Expired
22.2 KB
sha256:8f9eb68958361fb20d0e435da7b043018074389742f3917da561353a5610fb6b
mobsfscan Expired
3.44 KB
sha256:ce35257fe76f836b176d4c7266489edb5c2247f701616cfb6f2a2d1113ee0d1d
njsscan Expired
866 Bytes
sha256:3f3928ba21554df631a4493959aaf7cd49df5d140925f9fc60b16bab918777a8
noseyparker Expired
19.8 KB
sha256:fcc5a230625c9164d0665949a81de578d6128260d645e055c8150926ceef8db7
opengrep Expired
262 KB
sha256:9437af84fa2e4b570e354e6e849b598f6be25610b0a0b165dca9b032fdce4dac
regula Expired
6.97 KB
sha256:0f878a708146abb641fbab1b3484901b3bb158653ae97a1544ee8a08fd62cff0
retirejs Expired
463 Bytes
sha256:903f572cb9b5fda4c3e81c5a7e666659937e7b2f7c96e8845c82ff057429130d
rubocop Expired
313 Bytes
sha256:16b43edfe57e5ef3a0e360888948d192ee1ff0a02aff8ea2b78a4352ec8030e0
ruff Expired
20.2 KB
sha256:888affd30431773890e655d7c0edbd45854e9bcce6a9123a835fcb10f1d3d2bf
sbom.cdx.json Expired
6.98 KB
sha256:00286d2e920bcc54facf78772b9e72ebdd31b4d34e8e3f6a4e33881aeffa6872
scancode Expired
5.48 KB
sha256:234cd42ecf1c70465873e4fa82b0a95b3e6667179b504a3471dfd1b397d42e1d
shellcheck Expired
927 Bytes
sha256:10fcc994e30826367c6d46d6e1e8d128d6760d069f29d5ce32b9e5347c5e16cb
swiftlint Expired
14.6 KB
sha256:3356c048db57c164d05bc8a68aa9d2e035a7ce11f8ab735b69ec8ed7bce4905c
syft Expired
6.98 KB
sha256:00286d2e920bcc54facf78772b9e72ebdd31b4d34e8e3f6a4e33881aeffa6872
syft-image Expired
6.99 KB
sha256:fe9a8425bc80941b92740b58d4fc2b7a1c2aad87b70c5e5acd14565258d36d57
terrascan Expired
7.52 KB
sha256:43d48b219b66d61ea9fd2561b83c7dbed50cfa93337e15771afb83fd26cbfdd4
tfsec Expired
1.94 KB
sha256:9d5669e828bc25b887e41fbf5555f084b5be59199c0dc52aa126ce4a79a20955
trivy-config Expired
7.71 KB
sha256:8d717f63a6b9e99acde73c36f7752f56389d5db671fa5f6ba57b3303ec22d8eb
trivy-fs Expired
21.3 KB
sha256:a94bfaffc3966f35d2875fb19e938451e02200cf565d7d59419d0721f124e433
trufflehog Expired
996 Bytes
sha256:29b27c01b757ace686340e44adb8ee1fbcc72cda8abb58f436bd22301499ff23
zizmor Expired
6.67 KB
sha256:1a0f9ae0fca39ff3273a6ada2830c791fd4e23b2275f869354a4c4debc13e630