Vulnetix/cli/malscan action

The Vulnetix/cli/malscan GitHub Action: inputs, outputs, permissions and a complete workflow with artifact upload and attestation.

Installs the CLI and runs vulnetix malscan on path. It reads the dependencies installed on the runner and writes .vulnetix/malscan.sarif.

steps:
  - uses: actions/checkout@v5
  - uses: Vulnetix/cli/malscan@v4
    with:
      org-id: ${{ secrets.VULNETIX_ORG_ID }}
      api-key: ${{ secrets.VULNETIX_API_KEY }}

Runs vulnetix malscan --path <path>. Credentials are optional: without org-id and a credential the CLI runs in community mode. They reach the CLI only as environment variables; see Credentials.

Inputs

Input	Description	Default
`version`	Release of the Vulnetix CLI to install: an exact tag (v4.0.0), a major channel (v4, the newest v4 release) or latest	`v4`
`binary-path`	Path to an already-built vulnetix binary to use instead of downloading a release	-
`org-id`	Vulnetix organization ID (UUID), used with api-key. Optional: without credentials the CLI runs in community mode	-
`api-key`	Vulnetix API key. Passed to the CLI as VULNETIX_API_KEY, never on the command line	-
`api-token`	Vulnetix API token; the server resolves the organization. Passed as VULNETIX_API_TOKEN	-
`path`	Directory to scan	`.`
`args`	Extra arguments for the command, separated by spaces or newlines (no shell quoting is applied)	-
`artifact-name`	Upload every file the command wrote as a workflow artifact with this name	-
`fail-on-findings`	Fail the step when the command exits non-zero (findings over a gate, a breach, an error): true or false. The artifact, attestation and publish steps run either way	`true`
`github-token`	Token for GitHub publishing, release assets and pull request comments	`${{ github.token }}`
`attest`	Attest the written files with GitHub artifact attestations (needs id-token: write and attestations: write): true or false	`false`
`release-tag`	Attach every file the command wrote to the GitHub release with this tag (needs contents: write)	-

args is split on spaces and newlines. No shell quoting is applied, and nothing is evaluated.

Outputs

Output	Description
`files`	Every file the command wrote, one per line
`sarif`	The SARIF files it wrote, one per line
`sbom`	The CycloneDX SBOM it wrote, if any
`manifest`	The artifact manifest (JSON Lines) listing what it wrote
`exit-code`	The command’s exit code
`result`	success or failure
`summary`	One line saying what ran and how it ended

Permissions

contents: read to check out the repository
id-token: write and attestations: write with attest: true
contents: write with release-tag

Example workflow

name: Vulnetix malscan
on:
  push:
    branches: [main]
  pull_request:
jobs:
  malscan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: 22
      - run: npm ci
      - uses: Vulnetix/cli/malscan@v4
        with:
          org-id: ${{ secrets.VULNETIX_ORG_ID }}
          api-key: ${{ secrets.VULNETIX_API_KEY }}
          artifact-name: vulnetix-malscan
          attest: true

artifact-name uploads every file the command wrote as one workflow artifact. attest: true attests those files with GitHub artifact attestations.

Behaviour

Install the project’s dependencies first (npm ci, pip install, …). malscan reads what is installed, not what the lockfile declares.
The action has no github-code-scanning input. To send malscan.sarif to code scanning, add a github-publish step with sarif: .vulnetix/malscan.sarif, or use github/codeql-action/upload-sarif.
files lists the paths of everything the command wrote, one per line. sarif and sbom narrow that to the SARIF files and the CycloneDX SBOM.

Upload and attest in your own steps

The built-in artifact-name and attest inputs are the short form. To control those steps yourself, use the outputs. The action’s last step fails the job with the command’s exit code, so later steps need if: ${{ !cancelled() }}; the example turns the failure off and re-raises it at the end.

      - uses: Vulnetix/cli/malscan@v4
        id: vulnetix
        with:
          org-id: ${{ secrets.VULNETIX_ORG_ID }}
          api-key: ${{ secrets.VULNETIX_API_KEY }}
          fail-on-findings: false
      - uses: actions/upload-artifact@v7
        if: ${{ !cancelled() }}
        with:
          name: vulnetix-malscan
          path: ${{ steps.vulnetix.outputs.files }}
          include-hidden-files: true
      - uses: actions/attest-build-provenance@v4
        if: ${{ !cancelled() }}
        with:
          subject-path: ${{ steps.vulnetix.outputs.files }}
      - name: Fail on the command's exit code
        if: ${{ steps.vulnetix.outputs.exit-code != '0' }}
        env:
          EXIT_CODE: ${{ steps.vulnetix.outputs.exit-code }}
        run: exit "$EXIT_CODE"

Verify an attestation made this way with gh attestation verify <file> --repo <owner>/<repo>.