OpenGrep Scanner
OpenGrep SAST Scanner - Reusable Workflow
Runs the OpenGrep scanner via the argus Python CLI. Equivalent to: python -m argus scan opengrep
For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/sast-only.yml
uses: huntridge-labs/argus/.github/workflows/scanner-opengrep.yml@1.8.1
Triggers
- Manual dispatch
- Reusable (called by other workflows)
Permissions
| Scope | Access |
|---|---|
contents |
read |
security-events |
write |
actions |
read |
pull-requests |
write |
Inputs
| Input | Description | Required | Default |
|---|---|---|---|
post_pr_comment |
Whether to post PR comments boolean | No | True |
enable_code_security |
Whether GitHub Code Security is enabled for this repository boolean | No | False |
fail_on_severity |
Fail the job if vulnerabilities at or above this severity are found. Options: none, low, medium, high. Set to "none" ... string | No | none |
opengrep_config |
OpenGrep config (e.g., auto, p/default, p/security-audit, or path to custom rules) string | No | auto |
opengrep_paths |
Paths to scan (space-separated) string | No | . |
Jobs
opengrep-analysis — OpenGrep SAST
Runs on: ubuntu-latest · Timeout: 20 minutes · Continue on error: Yes
Steps:
- Checkout repository —
actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 - Set up Python —
actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 - Install Argus —
huntridge-labs/argus/.github/actions/setup-argus@1.8.1 - Run scan
- Upload artifacts —
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a - Upload SARIF —
github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a - Comment PR with results —
huntridge-labs/argus/.github/actions/comment-pr@1.8.1