DAST GitHub Action
The Nullify-Platform/dast-action repository contains an older composite wrapper for the public CLI. For new pipelines, use the current CLI engagement workflow: it exposes nullify pentest, supports a JSON --auth-config file, and lets you pin and verify a current CLI release.
Existing action installations
The wrapper checked with this documentation defaults to CLI 0.11.6, downloads the legacy version-suffixed executable, and calls nullify dast. Changing only nullify-version to a modern CLI release is not a supported migration: the command and release-asset formats differ.
app-name, spec-path, target-host
Passed to the legacy DAST command.
github-token, github-repository
Authenticate and associate the scan with its repository.
nullify-host
API host; set your tenant host explicitly. The legacy default is api.nullify.ai.
nullify-version, os-arch
Select the downloaded executable; defaults are 0.11.6 and linux_amd64.
local, image-label
Select local Docker execution and its image tag.
header
Used as the authentication argument when provided.
base-args
Raw arguments prepended to the command; only use trusted configuration.
The action declares additional login and multi-user inputs, but the execution step does not turn those inputs into an auth configuration. It optionally runs scripts/setup_auth.sh from the checked-out caller repository and then looks for ~/.nullify/auth_config.json. Declaring a user-* or auth-* input alone does not establish that it was used. The header path takes precedence over the file path, and its shell argument construction should be verified before relying on authenticated coverage.
The legacy download step does not verify a checksum. Pin and review the action revision in existing deployments, and migrate to a checksum-verified CLI installation for new work. Do not run secret-bearing pentests against untrusted pull-request code.
Local scans
Local execution needs Docker and network access to the target. It still communicates with the hosted tenant; it is not an offline scanner. See Private Networks for the data-flow and connectivity requirements.
Last updated