> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/tools/dast-action.md).

# DAST GitHub Action

The `Nullify-Platform/dast-action` repository contains an older composite wrapper for the public CLI. For new pipelines, use the current [CLI engagement workflow](/capabilities/pentests/engagement-workflow.md#continuous-integration): it exposes `nullify pentest`, supports a JSON `--auth-config` file, and lets you pin and verify a current CLI release.

## Existing action installations

The wrapper checked with this documentation defaults to CLI `0.11.6`, downloads the legacy version-suffixed executable, and calls `nullify dast`. Changing only `nullify-version` to a modern CLI release is not a supported migration: the command and release-asset formats differ.

| Input                                  | Wrapper behavior                                                                   |
| -------------------------------------- | ---------------------------------------------------------------------------------- |
| `app-name`, `spec-path`, `target-host` | Passed to the legacy DAST command.                                                 |
| `github-token`, `github-repository`    | Authenticate and associate the scan with its repository.                           |
| `nullify-host`                         | API host; set your tenant host explicitly. The legacy default is `api.nullify.ai`. |
| `nullify-version`, `os-arch`           | Select the downloaded executable; defaults are `0.11.6` and `linux_amd64`.         |
| `local`, `image-label`                 | Select local Docker execution and its image tag.                                   |
| `header`                               | Used as the authentication argument when provided.                                 |
| `base-args`                            | Raw arguments prepended to the command; only use trusted configuration.            |

The action declares additional login and multi-user inputs, but the execution step does not turn those inputs into an auth configuration. It optionally runs `scripts/setup_auth.sh` from the checked-out caller repository and then looks for `~/.nullify/auth_config.json`. Declaring a `user-*` or `auth-*` input alone does not establish that it was used. The header path takes precedence over the file path, and its shell argument construction should be verified before relying on authenticated coverage.

The legacy download step does not verify a checksum. Pin and review the action revision in existing deployments, and migrate to a checksum-verified CLI installation for new work. Do not run secret-bearing pentests against untrusted pull-request code.

## Local scans

Local execution needs Docker and network access to the target. It still communicates with the hosted tenant; it is not an offline scanner. See [Private Networks](/capabilities/pentests/private-networks.md) for the data-flow and connectivity requirements.