Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Outputs

The Odin Scan action exposes several outputs that you can reference in subsequent workflow steps. These are useful for conditional logic, notifications, or custom reporting.

Output Reference

OutputTypeDescription
analysis-idStringUnique identifier for the analysis run
statusStringFinal analysis status: completed or failed
total-findingsNumberTotal number of findings across all severities
critical-countNumberNumber of critical-severity findings
high-countNumberNumber of high-severity findings
medium-countNumberNumber of medium-severity findings
low-countNumberNumber of low-severity findings
report-urlStringURL to the full report on Odin Scan
sarif-fileStringLocal path to the generated SARIF file

Accessing Outputs

To use outputs, assign an id to the Odin Scan step and reference its outputs using the steps.<id>.outputs.<name> syntax:

steps:
  - uses: actions/checkout@v4

  - name: Run Odin Scan
    id: scan
    uses: odin-scan/odin-scan-action@v1
    with:
      api-key: ${{ secrets.ODIN_SCAN_API_KEY }}

  - name: Print results
    if: always()
    run: |
      echo "Analysis ID: ${{ steps.scan.outputs.analysis-id }}"
      echo "Status: ${{ steps.scan.outputs.status }}"
      echo "Total Findings: ${{ steps.scan.outputs.total-findings }}"
      echo "Critical: ${{ steps.scan.outputs.critical-count }}"
      echo "High: ${{ steps.scan.outputs.high-count }}"
      echo "Medium: ${{ steps.scan.outputs.medium-count }}"
      echo "Low: ${{ steps.scan.outputs.low-count }}"
      echo "Report: ${{ steps.scan.outputs.report-url }}"

Use if: always() on steps that reference outputs to ensure they run even when the scan step fails due to findings exceeding the severity threshold.

Example: Conditional Notification

You can use outputs to trigger notifications only when critical findings are detected:

- name: Notify on critical findings
  if: always() && steps.scan.outputs.critical-count != '0'
  run: |
    curl -X POST "${{ secrets.SLACK_WEBHOOK }}" \
      -H 'Content-Type: application/json' \
      -d '{
        "text": "Odin Scan found ${{ steps.scan.outputs.critical-count }} critical findings in ${{ github.repository }}. Report: ${{ steps.scan.outputs.report-url }}"
      }'

Example: Custom Threshold Logic

If you need more granular control than the built-in severity-threshold input, you can use outputs to implement custom pass/fail logic:

- name: Check findings
  if: always()
  run: |
    CRITICAL=${{ steps.scan.outputs.critical-count }}
    HIGH=${{ steps.scan.outputs.high-count }}
    TOTAL=$((CRITICAL + HIGH))
    if [ "$TOTAL" -gt 5 ]; then
      echo "Too many high+ findings ($TOTAL). Failing."
      exit 1
    fi