v17.2.2

Changed

• Updated the pinned scan engine versions in tools.lock.json: ESLint 10.13.0, gosec 2.30.0, Kotlin compiler 2.4.21, OpenGrep 1.32.0, Semgrep 1.182.1, SpotBugs 4.10.5, Trivy 0.76.1, TruffleHog 3.99.7 and zizmor 1.31.1.

See the changelog for details.

v17.2.1

Changed

• hadolint, gosec, zizmor, gitleaks, betterleaks, trufflehog and trivy reuse a binary already on PATH only when it reports the version pinned in tools.lock.json, as oxlint, OpenGrep, Semgrep and Bandit already did. A different version is ignored with the warning Ignoring <tool> from PATH because it is not the pinned version <version>, and the pinned release is downloaded and verified instead. Scan results no longer depend on a scanner preinstalled on the runner image, and the pinned version shown in the reports is the one that ran.

See the changelog for details.

v17.2.0

Added

• New JSON report polyscan-report.json (input json-report, default true; output json-file) with the scan context, Quality Gate thresholds and result, per-engine status, pinned tool version (pinnedVersion, only for engines that ran successfully), duration and severity counts, and all findings. It is included in the uploaded artifact.
• The job summary shows the scanned target, commit, total duration and PolyScan version. The engine list is now a table with each engine's pinned tool version, duration and findings per severity. The Quality Gate section lists found vs. allowed counts per gated severity.
• SARIF rules carry security/CWE tags and, when all of a rule's findings agree, security-severity, a default level and helpUri, so GitHub Code Scanning shows severities and links to rule documentation. Pinned engine versions are listed under tool.extensions and engine failures or skip reasons under invocations; the run counts as unsuccessful only when engines failed and none succeeded.

Security

• Report files (polyscan.sarif, polyscan.sbom.json, polyscan-report.json, polyscan-summary.md) are no longer written through a symlink. A repository could check in a symlink with a report's name that points outside the workspace, and the write followed it and overwrote the target. PolyScan now fails with refusing to write report through symlink instead.
• Bundled undici raised to 6.29.1 (GHSA-4qv8-2p9j-2685, GHSA-xjj6-f33q-929c: denial of service via the EventSource parser and excessive content-encodings).

See the changelog for details.

v17.1.0

Added

• New artifact-name input (default polyscan-reports) to choose the name of the uploaded report artifact, e.g. one name per matrix leg.

Fixed

• The report upload no longer fails with (409) Conflict: an artifact with this name already exists on the workflow run when PolyScan runs more than once in a workflow run (matrix legs, several jobs or steps). If the requested name is taken, the upload falls back to <name>-<job> and then to <name>-<job>-<random>; the log names the artifact actually used.

See the changelog for details.

v17.0.1

Fixed

• A scan no longer crashes with Error: spawn ETXTBSY when several engines download their tools at the same time. Starting a freshly installed binary can briefly fail while another concurrently started process still holds it open for writing; PolyScan now retries the start. Previously the error escaped as an unhandled rejection from @actions/exec and aborted the whole action.

See the changelog for details.

v17.0.0

Breaking: engines: "all" now runs oxlint instead of eslint, and JS/TS findings use oxlint/<rule> rule IDs. Existing code scanning alerts from eslint/<rule> close and reopen under the new IDs. Pin @v16 if you need the old behaviour.

Added

• New oxlint engine for JavaScript/TypeScript (including JSX/TSX). It runs no-eval, no-implied-eval, no-new-func, no-script-url and react/no-danger from a pinned, SHA-256-verified standalone binary, is skipped when no JS/TS files are present, and reports files it cannot parse or does not lint (minified names, non-lowercase extensions) in the engine note instead of dropping them silently. It runs outside the scanned target, so a repository's oxlint-suppressions.json cannot hide findings.

Changed

• engines: "all" now runs oxlint instead of eslint. ESLint stays available as an opt-in engine (engines: "eslint,...") but its default parser cannot read TypeScript syntax, so it never reported findings in .ts/.tsx files.

Fixed

• Bandit and Semgrep reuse a preinstalled executable only when it reports the version pinned in tools.lock.json; otherwise the pinned release is installed in an isolated environment, so scan results stay reproducible.
• The SARIF driver and the CycloneDX SBOM tool entry report the release version (17.0.0) instead of the placeholder 1.0.0.

See the README for usage and the changelog for details.

v16.1.0

Added

• New semgrep-exclude-rules and opengrep-exclude-rules inputs accept comma-separated rule IDs. Excluded rules are skipped by their own scanner while other rules continue scanning the same files.

Changed

• Semgrep and OpenGrep now show full scanner rule IDs in the job summary and SARIF, making them directly usable in the new inputs.
• Updated the pinned ESLint, OpenGrep, Semgrep, trufflehog, and zizmor versions.

See the README example for rule exclusion syntax and the changelog for details.

v16.0.3

What's Changed

• Backfill CHANGELOG for v16.0.1 and add v16.0.2 entry by @sraisl in #53
• Add repo Copilot instructions, custom agents, and skills by @sraisl in #54
• Prevent concurrent release workflow runs by @sraisl in #55
• chore(deps-dev): bump @types/node from 26.4.0 to 26.4.1 by @dependabot[bot] in #56
• chore: update scan engine tool versions by @sraisl in #50
• Remove concurrency configuration from release.yml by @sraisl in #57
• chore: rebuild dist to match current src/package-lock by @sraisl in #58

Full Changelog: v16.0.2...v16.0.3

v16.0.2

What's Changed

• Add betterleaks secrets-scanning engine by @sraisl in #51
• Rebuild dist after betterleaks autofix commits by @sraisl in #52

Full Changelog: v16.0.1...v16.0.2

PolyScan v16.0.1

Marketplace naming fix

This release updates the Marketplace display name to PolyScan SAST Security Scanner.

Use sraisl/polyscan-action@v16 for compatible minor and patch updates, or pin @v16.0.1 for an immutable release.

See CHANGELOG.md for details.