SCA action

Last updated: Jun 25, 2026

The SCA action runs Fluid Attacks' software composition analysis scanner in your GitHub Actions workflows, detecting known vulnerabilities in your third-party dependencies by checking package manifests against the Fluid Attacks vulnerability database.

Marketplace: fluidattacks/sca-action

Scan modes

By default the action always runs a full scan, regardless of the workflow trigger. Differential scanning must be opted into explicitly via the scanner_mode input.

The scanner detects dependency files automatically: package.json, pom.xml, *.csproj, requirements.txt, and more.

Setup

1. Create the workflow

Add .github/workflows/sca.yml to your repository:

name: SCA
on:
  push:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: fluidattacks/sca-action@<version>
        id: scan

      # Optional: upload findings to the GitHub Security tab
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: ${{ steps.scan.outputs.sarif_file }}

• upload-sarif is optional. When included, run it with if: always() so results are uploaded even when the scan step exits with a non-zero code (e.g., when strict: true).

Without a configuration file, the action scans the entire repository and writes results to .fluidattacks-sca-results.sarif.

2. (Optional) Add a configuration file

To customize scan paths, output format, or strict mode, create a YAML configuration file anywhere in your repository and pass its path to the action via scan_config_path:

- uses: fluidattacks/sca-action@<version>
  id: scan
  with:
    scan_config_path: .github/sca-config.yaml

The path is relative to the repository root. The job fails immediately if the file does not exist at the given path.

3. Push and run

Commit the workflow file and push. The scan runs automatically on the next push or pull request.

Configuration

When scan_config_path is provided, the action uses that file exclusively. When omitted, the action runs with built-in defaults: scans the entire repository (sca.include: [.]) and writes results to .fluidattacks-sca-results.sarif.

language: EN
strict: false
output:
  file_path: results.sarif
  format: SARIF
sca:
  include:
    - .
  exclude: # Optional: paths to exclude from scanning
    - vendor/

• language — language for vulnerability descriptions in the output (EN for English, ES for Spanish).
• strict — when false, the scanner reports findings but does not fail the pipeline. Set to true to break the build on any detected vulnerability.
• output.file_path — use a distinct name (e.g., results-sca.sarif) to avoid overwriting the SAST results file if both scanners run in the same workspace. When format is SARIF or ALL, this path is also exposed as the sarif_file action output.
• output.format — SARIF produces the standard format consumed by GitHub's code scanning API. Use CSV for a spreadsheet-friendly report, or ALL to generate both results-sca.sarif and results-sca.csv.
• sca.include — list of paths the scanner searches for dependency manifests. A single . means the entire repository.
• sca.exclude — optional list of paths to skip.

Action inputs

Running a differential scan

Use scanner_mode: diff to scan only the files that changed relative to the default branch (or the PR base branch on pull requests). Remember to set fetch-depth: 0 in the checkout step so git history is available:

- uses: actions/checkout@v4
  with:
    fetch-depth: 0

- uses: fluidattacks/[email protected]
  id: scan
  with:
    scanner_mode: diff

Action outputs

You can use these outputs in subsequent workflow steps:

- name: Comment on PR
  if: steps.scan.outputs.vulnerabilities_found == 'true'
  run: echo "Vulnerable dependencies detected — check the Security tab."

Common scenarios

Monorepo: scan only specific folders

sca:
  include:
    - services/api/
    - services/web/
  exclude:
    - services/legacy/

Use this option if you use the scanner mode full, but you wish to only analyze certain directories.

Strict mode: block merges with vulnerable dependencies

For common scenarios and troubleshooting, see GitHub Actions.

Troubleshooting

Differential scan analyzes all files instead of just changes

Verify that fetch-depth: 0 is set in the actions/checkout step and that scanner_mode: diff is explicitly passed to the action. Without both, the action runs a full scan.

For common scenarios and troubleshooting, see GitHub Actions.

See the Marketplace page for all configuration options and additional troubleshooting.