Skip to content

OpenGrep Scanner

OpenGrep SAST Scanner - Reusable Workflow

Runs the OpenGrep scanner via the argus Python CLI. Equivalent to: python -m argus scan opengrep

For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/sast-only.yml

uses: huntridge-labs/argus/.github/workflows/scanner-opengrep.yml@1.1.0

Triggers

  • Manual dispatch
  • Reusable (called by other workflows)

Permissions

Scope Access
contents read
security-events write
actions read
pull-requests write

Inputs

Input Description Required Default
post_pr_comment Whether to post PR comments boolean No True
enable_code_security Whether GitHub Code Security is enabled for this repository boolean No False
fail_on_severity Fail the job if vulnerabilities at or above this severity are found. Options: none, low, medium, high. Set to "none" ... string No none
opengrep_config OpenGrep config (e.g., auto, p/default, p/security-audit, or path to custom rules) string No auto
opengrep_paths Paths to scan (space-separated) string No .

Jobs

opengrep-analysis — OpenGrep SAST

Runs on: ubuntu-latest · Timeout: 20 minutes · Continue on error: Yes

Steps:

  1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Set up Python — actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
  3. Install Argus
  4. Run scan
  5. Upload artifacts — actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
  6. Upload SARIF — github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13
  7. Comment PR with results — huntridge-labs/argus/.github/actions/comment-pr@1.1.0