offensive360/sast-scan-actionGitHub Action: Offensive360 SAST scan with SARIF output for code scanning. 60+ languages. Free for open source.
Run a full Offensive360 static application security scan (SAST) on every push or pull request. Deep taint and data-flow analysis across 60+ languages, results as SARIF for the GitHub code scanning tab, and a severity gate for your pipeline.
Free for open source: public repositories can request a free scan token — see offensive360.com/free-for-open-source.
name: SAST
on:
push:
branches: [main]
pull_request:
permissions:
contents: read
security-events: write # only needed when upload-sarif is enabled
jobs:
sast:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: offensive360/sast-scan-action@v1
with:
api-url: https://sast.offensive360.com # or your own on-prem instance
api-token: ${{ secrets.O360_API_TOKEN }}
upload-sarif: 'true'
fail-on: high
Findings then appear under Security → Code scanning with file/line locations, impact and remediation guidance, and full traces in your Offensive360 dashboard.
Store the token as a repository secret (e.g. O360_API_TOKEN). Never commit it.
| Input | Default | Description |
|---|---|---|
api-url | — (required) | Base URL of your Offensive360 instance |
api-token | — (required) | External scan token (repository secret) |
project-name | repository name | Project name in the Offensive360 dashboard |
path | . | Directory to scan |
dependency-scan | false | Also run dependency (SCA) analysis |
malware-scan | false | Also run malware / binary tampering analysis |
license-scan | false | Also run license compliance analysis |
fail-on | high | Fail the job at/above this severity: none, low, medium, high, critical |
sarif-file | offensive360.sarif | Path of the SARIF report to write |
timeout-seconds | 3000 | Max seconds to wait for the scan |
exclude | .git node_modules dist … | Space-separated directory names excluded from upload |
upload-sarif | false | Upload SARIF to GitHub code scanning (needs security-events: write) |
| Output | Description |
|---|---|
total, critical, high, medium, low | Finding counts |
status | Scan status (Succeeded, PartialFailed, …) |
sarif-file | Path of the generated SARIF report |
project-id | Offensive360 project id for this repository |
Example — comment counts into later steps:
- uses: offensive360/sast-scan-action@v1
id: o360
with:
api-url: ${{ vars.O360_API_URL }}
api-token: ${{ secrets.O360_API_TOKEN }}
- run: echo "Found ${{ steps.o360.outputs.total }} issues (${{ steps.o360.outputs.critical }} critical)"
Using GitLab? Include the equivalent template from this repo:
include:
- remote: 'https://raw.githubusercontent.com/offensive360/sast-scan-action/main/templates/gitlab-ci.yml'
and set O360_API_URL plus a masked O360_API_TOKEN CI/CD variable.
The scan behaves identically (same API, ExternalScanSourceType=GitLab).
bash, zip, curl, python3 — all preinstalled).path, or use your own instance.PartialFailed when some language engines
succeeded and others failed — SARIF still contains all completed findings.One platform for SAST, DAST, MAST, SCA, malware & binary analysis, and license compliance — flat pricing, unlimited users and scans, on-premise or cloud. offensive360.com · Book a demo