{"id":15048076,"url":"https://github.com/github/ossar-action","last_synced_at":"2025-04-09T12:07:08.026Z","repository":{"id":40474660,"uuid":"274723380","full_name":"github/ossar-action","owner":"github","description":"Run multiple open source security static analysis tools without the added complexity with OSSAR (Open Source Static Analysis Runner).","archived":false,"fork":false,"pushed_at":"2024-04-18T09:05:07.000Z","size":307,"stargazers_count":96,"open_issues_count":8,"forks_count":27,"subscribers_count":262,"default_branch":"main","last_synced_at":"2025-03-30T23:31:51.065Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/github.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-06-24T16:59:35.000Z","updated_at":"2025-03-09T13:58:32.000Z","dependencies_parsed_at":"2024-06-18T12:30:25.323Z","dependency_job_id":null,"html_url":"https://github.com/github/ossar-action","commit_stats":{"total_commits":51,"total_committers":5,"mean_commits":10.2,"dds":"0.13725490196078427","last_synced_commit":"4e96c4f6e591eb4b991abfd459e40b136a317aea"},"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fossar-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fossar-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fossar-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fossar-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/github","download_url":"https://codeload.github.com/github/ossar-action/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247953117,"owners_count":21023945,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-24T21:07:52.614Z","updated_at":"2025-04-09T12:07:08.009Z","avatar_url":"https://github.com/github.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# github/ossar-action\n\n![OSSAR windows-latest](https://github.com/github/ossar-action/workflows/OSSAR%20windows-latest/badge.svg)  \n![OSSAR ubuntu-latest](https://github.com/github/ossar-action/workflows/OSSAR%20ubuntu-latest/badge.svg)\n\nRun open source security static analysis tools without the added complexity with OSSAR (Open Source Static Analysis Runner).\n\n# Limitations\n\nThe OSSAR action is currently in beta and runs on the `windows-latest` queue, as well as Windows self hosted agents. `ubuntu-latest` support coming soon.\n\n# Overview\n\nThis action runs the [Microsoft Security DevOps CLI](https://aka.ms/msdo-nuget) for security analysis by:\n\n* Installing the Microsoft Security DevOps CLI\n* Installing the latest policy or referencing the local `policy/github.gdnpolicy` file\n* Installing the latest open source tools\n* Automatic or user-provided configuration of static analysis tools\n* Execution of a full suite of static analysis tools\n* Normalized processing of results into the SARIF format\n* Exports a single SARIF file which can be uploaded via the `github/codeql-action/upload-sarif` action\n\n# Open Source Tools\n\nThe following table documents what tools are currently run by this action (if applicable or configured) and the language(s) or artifact(s) they can analyze.\n\n| Name | Analysis Coverage |\n| --- | --- |\n| [Bandit](https://github.com/PyCQA/bandit) | python |\n| [BinSkim](https://github.com/Microsoft/binskim) | binary - Windows, ELF |\n| [ESlint](https://github.com/eslint/eslint) | JavaScript |\n\nTo request a tool be integrated, please file a [new a GitHub issue](https://github.com/github/ossar-action/issues/new) in this repo.\n\n# Usage\n\nSee [action.yml](action.yml)\n\n## Basic\n\nRun OSSAR with the default policy and recommended tools.\n\n```yaml\nsteps:\n- uses: actions/checkout@v2\n- name: Run OSSAR\n  uses: github/ossar-action@v1\n  id: ossar\n- name: Upload results to Security tab\n  uses: github/codeql-action/upload-sarif@v2\n  with:\n    sarif_file: ${{ steps.ossar.outputs.sarifFile }}\n```\n\n**Note:** The [Microsoft Security DevOps CLI](https://aka.ms/msdo-nuget) is built with net6.0. A version greater than or equal to net6.0 of dotnet must be installed on the runner in order to run this action. GitHub hosted runners already have a compatible version of dotnet installed. To ensure a compatible version of dotnet is installed on a self-hosted runner, please configure the [actions/setup-dotnet](https://github.com/actions/setup-dotnet) action.\n\n```\n- uses: actions/setup-dotnet@v1\n  with:\n    #     dotnet-version: '6.0.x'\n```\n\n## Upload Results to the Security tab\n\nTo upload results to the Security tab of your repo, run the `github/codeql-action/upload-sarif` action immediately after running OSSAR. OSSAR sets the action output variable `sarifFile` to the path of a single SARIF file that can be uploaded to this API.\n\n```yaml\n- name: Upload results to Security tab\n  uses: github/codeql-action/upload-sarif@v1\n  with:\n    sarif_file: ${{ steps.ossar.outputs.sarifFile }}\n```\n\n# More Information\n\nPlease see the [wiki tab](https://github.com/github/ossar-action/wiki) for more information and the [Frequently Asked Questions (FAQ)](https://github.com/github/ossar-action/wiki/FAQ) page.\n\n# Report Issues\n\nPlease [file a GitHub issue](https://github.com/github/ossar-action/issues/new) in this repo. To help us investigate the issue, please include a description of the problem, a link to your workflow run (if public), and/or logs from the OSSAR's action output.\n\n# License\n\nThe scripts and documentation in this project are released under the [MIT License](LICENSE)\n\n# Contributing\n\nContributions are welcome! See the [Contributor's Guide](CONTRIBUTING.md).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Fossar-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgithub%2Fossar-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Fossar-action/lists"}