v2.0.0 — Jenkins-parity inputs and outputs

Major release

Adds full SAST support, async mode, threshold actions, custom endpoints, and GitHub Actions outputs / step summary. Brings the action to feature-parity with the official Sec1 Jenkins plugin.

Highlights

• Runs both SCA (FOSS) and SAST by default
• New inputs: runSca, runSast, scanTag, scmUrl, sastIncrementalScan, asyncScan, actionOnThresholdBreached, instanceUrl, dashboardUrl
• New outputs: reportUrl, critical, high, medium, low, totalCve, scanStatus
• Threshold breach actions: fail | unstable | continue
• GitHub step summary with vulnerability counts + report link
• Image hosted at us-central1-docker.pkg.dev/cve-buster/sec1-public-repo/sec1-foss-security:v3 (anonymous pull, multi-arch)

Breaking

• Default behavior changed: previously only SCA ran; now both SCA and SAST run unless explicitly disabled via runSca / runSast.

Back-compat

• Legacy scanType input still works (sast | foss | both).

Quick example

- uses: sec0ne/actions/security@v2
  with:
    apikey: ${{ secrets.SEC1_API_KEY }}