SAST action

Last updated: Oct 26, 2026

The SAST action runs Fluid Attacks' static application security testing scanner in your GitHub Actions workflows. It detects vulnerabilities in your source code on each push and pull request.

If you want, you can attribute the runs to your Fluid Attacks group. For the setup, read Authentication.

Marketplace: fluidattacks/sast-action

Scan modes

The action automatically selects the scan mode from the workflow trigger. The action detects the default branch automatically with git remote show origin. Thus, all branch names (such as main, master, trunk and develop) work without configuration.

Setup

1. Create the workflow

Add .github/workflows/sast.yml to your repository:

name: SAST
on:
  push:
  pull_request:
    types: [opened, synchronize, reopened]
  schedule:
    - cron: "0 8 * * 1" # optional: weekly full scan every Monday at 8am

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Required for differential scanning

      - uses: fluidattacks/sast-action@<version> # Use latest released version
        id: scan

      # Optional: upload findings to the GitHub Security tab
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: ${{ steps.scan.outputs.sarif_file }}

• fetch-depth: 0 gets the full git history. Without it, the action cannot find which files changed relative to the default branch, and differential scans do not work correctly. You can omit it only if you force scanner_mode: full.
• upload-sarif is optional. If you use it, run it with if: always(). Thus, the step uploads the results each time, also when the scan step exits with a non-zero code (for example, when strict: true is set).

Without a configuration file, the action scans the full repository and writes the results to .fluidattacks-sast-results.sarif.

2. (Optional) Add a configuration file

To customize scan paths, output format, or strict mode, create a YAML configuration file in a location that you select in your repository. Then, give its path to the action with scan_config_path:

- uses: fluidattacks/sast-action@<version>
  id: scan
  with:
    scan_config_path: .github/sast-config.yaml

The path is relative to the repository root. If the file does not exist at that path, the job fails immediately.

3. Push and run

Commit the workflow file and push. The scan runs automatically on the subsequent push or pull request.

Configuration

When you give scan_config_path, the action uses only that file. If you do not give it, the action uses the built-in default values: it scans the full repository (sast.include: [.]) and writes the results to .fluidattacks-sast-results.sarif.

language: EN
strict: false
output:
  file_path: results.sarif
  format: SARIF
sast:
  include:
    - .
  exclude: # Optional: paths to exclude from scanning
    - node_modules
    - vendor

• language — language for vulnerability descriptions in the output (EN for English, ES for Spanish).
• strict — when false, the scanner reports findings but does not fail the pipeline. Set it to true to break the build when the scanner detects a vulnerability.
• output.file_path — path where the results file is written. When the format is SARIF or ALL, the sarif_file action output also shows this path.
• output.format — SARIF gives the standard format that GitHub's code scanning API uses. Use CSV for a report that you can open in a spreadsheet, or ALL to generate results.sarif and results.csv.
• sast.include — list of paths that the scanner analyzes. A single . means the full repository.
• sast.exclude — optional list of paths that the scanner does not analyze.
• checks — optional list of specific check IDs to run. If you omit it, the scanner runs all checks.

Action inputs

Forcing a full scan

Use scanner_mode: full to scan the full repository on each run, for all triggers. This is useful for scheduled audits:

- uses: fluidattacks/[email protected]
  id: scan
  with:
    scanner_mode: full

Action outputs

You can use these outputs in the subsequent workflow steps:

- name: Comment on PR
  if: steps.scan.outputs.vulnerabilities_found == 'true'
  run: echo "Vulnerabilities detected — check the Security tab."

Common scenarios

Monorepo: scan only specific folders

sast:
  include:
    - services/api/
    - services/web/
  exclude:
    - services/legacy/

Use this option if you use the full scanner mode and you want to analyze only some directories.

Strict mode: block merges with vulnerabilities

For common scenarios and troubleshooting, read GitHub Actions.

Troubleshooting

The action fails to detect the default branch

The action runs git remote show origin to detect the default branch. For this command, the checkout step must have fetch-depth: 0, so that the remote metadata is available.

For common scenarios and troubleshooting, read GitHub Actions.

Read the Marketplace page for all the configuration options and more troubleshooting.