scan ci tip

The scan ci tip command is used for scanning the tip of a branch in a continous integration workflow.

Authentication

The command is intended to be used offline as part of a CI workflow within an application (such as GitHub). There should not be any additional Auth needed.

Usage

Usage: vault-radar scan ci tip [options]

Command Options

• --clone-dir, -c: Define a path to a clone of the repository. If not defined, the current directory is used.
• --outfile, -o: Define the localtion to a file where information about found secrets will be stored.
• --format, -f: Define the output format. Supported values: csv, json, and sarif. json is the default if this is option is not defined.
• --fail-severity, -s: Define the severity level of found risks that will cause the command to fail. Supported values: info, low, medium, high, and critical.
• --log-path, -l: Define the path to a file where logging will be output to.
• --skip-ignored: Specifies that risks with the ignore tag should be skipped.
• --pretty, -p: Define how to output information about found risk.
• --summary-pretty: Define how to output summary about all found risks. Supported values are: markdown. Defaults to skipping the summary output.
• --summary-outfile: Define the file to output the summary to. Defaults to stdout.

Tip of Branch Scan

This scan will fail when a risk of high severity is found, output information about found risks to a file vault-radar.jsonl, log information to a file vault-radar.log and output the results to stdout in a format for GitHub Actions.

vault-radar scan ci tip -s high -o vault-radar.jsonl -l vault-radar.log --pretty=gha