shiftleft-sca-action/action.yaml at main · orcasecurity/shiftleft-sca-action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
name: "Orca Security - SCA Security"
description: "Configures Orca CLI to run Software Composition Analysis (SCA) scans for vulnerability and license detection"
branding:
  icon: "shield"
  color: "green"
runs:
  using: "docker"
  image: "Dockerfile"
  env:
    WORKSPACE_PATH: $GITHUB_WORKSPACE

inputs:
  api_token:
    description: "Orca API Token used for Authentication"
    required: true
  exit_code:
    description: "Exit code for failed execution due to policy violations"
    required: false
  no_color:
    description: "Disable color output"
    required: false
    default: "false"
  project_key:
    description: "Project Key name"
    required: true
  silent:
    description: "Disable logs and warnings output"
    required: false
    default: "false"
  disable_err_report:
    description: "Suppress error reporting to the monitoring platform"
    required: false
    default: "false"
  path:
    description: "Path or directory to scan"
    required: true
  security_checks:
    description: "List of security issues to detect (comma-separated: vulns, license, malicious)"
    required: false
    default: "vulns,license,malicious"
  exceptions_filepath:
    description: "Path to exceptions YAML file"
    required: false
  exclude_paths:
    description: "List of paths to be excluded from scan (comma-separated)"
    required: false
  format:
    description: "Format for displaying the results (table, json, sarif, glsast, gl-dependency-scan)"
    required: false
    default: "table"
  output:
    description: "Output directory"
    required: false
  console_output:
    description: "Prints results to console in the provided format (only when --output is provided)"
    required: false
    default: "table"
  hide_vulnerabilities:
    description: "Do not show detailed view of the vulnerabilities findings"
    required: false
    default: "false"
  hide_skipped_vulnerabilities:
    description: "Filter out skipped vulnerabilities from result"
    required: false
    default: "false"
  show_failed_issues_only:
    description: "Show only failed issues in CLI results"
    required: false
    default: "false"
  dependency_tree:
    description: "Show dependency origin tree of vulnerable packages"
    required: false
    default: "false"
  non_strict_package_detection:
    description: "Detect vulnerabilities with version ranges instead of exact versions"
    required: false
    default: "false"
  skip_remote_lookup:
    description: "Do not perform remote lookups for package information"
    required: false
    default: "false"
  timeout:
    description: 'Set the maximum duration for the CLI execution. valid time units ("s", "m", "h")'
    required: false
  config:
    description: "Path to configuration file (json, yaml or toml)"
    required: false
  show_annotations:
    description: "Show github annotations on pull requests"
    required: false
    default: "true"
  display_name:
    description: "Scan log display name (on Orca platform)"
    required: false
  debug:
    description: "Debug mode"
    required: false
    default: "false"
  log_path:
    description: "The directory path to specify where the logs should be written to on debug mode. Default to the current working directory"
    required: false
  file_patterns:
    description: "Use this flag when you have dependency files with non-standard names that the scanner wouldn't recognize by default. Indicate which analyzer (e.g., Python, Docker, npm) to use for a specific file pattern. Format: <analyzer>:<path> . Example: pip:requirements-.*\\.txt"
    required: false

outputs:
  exit_code:
    description: "The exit code of the scan"