SCA action

Last updated: Oct 26, 2026

The SCA action runs Fluid Attacks' software composition analysis scanner in your GitHub Actions workflows. It detects known vulnerabilities in your third-party dependencies. To do this, it compares the package manifests with the Fluid Attacks vulnerability database.

If you want, you can attribute the runs to your Fluid Attacks group. For the setup, read Authentication.

Marketplace: fluidattacks/sca-action

Scan modes

By default, the action always runs a full scan, for all workflow triggers. To use differential scanning, set it explicitly with the scanner_mode input.

The scanner detects these dependency files automatically: package.json, pom.xml, *.csproj, requirements.txt, and more.

Setup

1. Create the workflow

Add .github/workflows/sca.yml to your repository:

name: SCA
on:
  push:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: fluidattacks/sca-action@<version>
        id: scan

      # Optional: upload findings to the GitHub Security tab
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: ${{ steps.scan.outputs.sarif_file }}

• upload-sarif is optional. If you use it, run it with if: always(). Thus, the step uploads the results each time, also when the scan step exits with a non-zero code (for example, when strict: true is set).

Without a configuration file, the action scans the full repository and writes the results to .fluidattacks-sca-results.sarif.

2. (Optional) Add a configuration file

To customize scan paths, output format, or strict mode, create a YAML configuration file in a location that you select in your repository. Then, give its path to the action with scan_config_path:

- uses: fluidattacks/sca-action@<version>
  id: scan
  with:
    scan_config_path: .github/sca-config.yaml

The path is relative to the repository root. If the file does not exist at that path, the job fails immediately.

3. Push and run

Commit the workflow file and push. The scan runs automatically on the subsequent push or pull request.

Configuration

When you give scan_config_path, the action uses only that file. If you do not give it, the action uses the built-in default values: it scans the full repository (sca.include: [.]) and writes the results to .fluidattacks-sca-results.sarif.

language: EN
strict: false
output:
  file_path: results.sarif
  format: SARIF
sca:
  include:
    - .
  exclude: # Optional: paths to exclude from scanning
    - vendor/

• language — language for vulnerability descriptions in the output (EN for English, ES for Spanish).
• strict — when false, the scanner reports findings but does not fail the pipeline. Set it to true to break the build when the scanner detects a vulnerability.
• output.file_path — use a different name (for example, results-sca.sarif). Thus, the SCA results do not replace the SAST results file if the two scanners run in the same workspace. When the format is SARIF or ALL, the sarif_file action output also shows this path.
• output.format — SARIF gives the standard format that GitHub's code scanning API uses. Use CSV for a report that you can open in a spreadsheet, or ALL to generate results-sca.sarif and results-sca.csv.
• sca.include — list of paths where the scanner searches for dependency manifests. A single . means the full repository.
• sca.exclude — optional list of paths that the scanner does not analyze.

Action inputs

Running a differential scan

Use scanner_mode: diff to scan only the files that changed relative to the default branch (or the PR base branch on pull requests). Set fetch-depth: 0 in the checkout step, so that the git history is available:

- uses: actions/checkout@v4
  with:
    fetch-depth: 0

- uses: fluidattacks/[email protected]
  id: scan
  with:
    scanner_mode: diff

Action outputs

You can use these outputs in the subsequent workflow steps:

- name: Comment on PR
  if: steps.scan.outputs.vulnerabilities_found == 'true'
  run: echo "Vulnerable dependencies detected — check the Security tab."

Common scenarios

Monorepo: scan only specific folders

sca:
  include:
    - services/api/
    - services/web/
  exclude:
    - services/legacy/

Use this option if you use the full scanner mode and you want to analyze only some directories.

Strict mode: block merges with vulnerable dependencies

For common scenarios and troubleshooting, read GitHub Actions.

Troubleshooting

Differential scan analyzes all files instead of just changes

Make sure that you give scanner_mode: diff explicitly to the action. Without this input, the action always runs a full scan. Also, make sure that fetch-depth: 0 is set in the actions/checkout step. Without the full Git history, the differential scan does not work correctly.

For common scenarios and troubleshooting, read GitHub Actions.

Read the Marketplace page for all the configuration options and more troubleshooting.