WAF++ Logo WAF++
v0.1.1 · Marketplace · Open Source

Compliance checks in your
GitHub Actions.

Add WAF++ PASS to any workflow. Scan Terraform, Bicep, CDK, or Pulumi on every pull request and push, then send the full result payload to your WAFPass server for dashboards, gap analysis, and audit evidence.

Get the action → View on GitHub Install WAFPass
Terraform Bicep CDK Pulumi Bearer token API key Fail policies
v0.1.1
Action release
4
IaC frameworks
2
Auth modes
0
Cloud credentials needed
Features

One step. Full visibility.

The action handles CLI installation, scanning, result upload, and policy enforcement so your team can focus on shipping.

Auto-install CLI

Installs the latest wafpass-core from PyPI automatically, or override with a custom pip source or pre-installed binary.

Multi-IaC scan

Scan Terraform, Bicep, CDK, or Pulumi files in a single step. Supports multiple paths and Terraform plan JSON for change overview.

Push to server

Uploads the full wafpass-result.json payload to POST /api/v1/runs so dashboards and evidence packages stay current.

Policy gates

Configurable fail_on policies from never to critical. Fail the step after the result is safely stored on the server.

Flexible auth

Use a Bearer token for interactive users or an ingest API key for headless CI/CD runs. Both forwarded securely to the server.

CI/CD metadata

Marks runs as is_cicd: true with triggered_by: github-actions, and passes branch, commit SHA, project, and stage automatically.

Usage

Add it to any workflow.

Check out your repo, run the action, and surface compliance results where your team already works.

.github/workflows/wafpass.yml 
name: WAF++ PASS Scan

on:
  push:
    branches: [main, develop]
  pull_request:

jobs:
  wafpass:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run WAF++ PASS
        uses: WAF2p/wafpass-action@v0.1.1
        with:
          server_url: ${{ vars.WAFPASS_SERVER_URL }}
          api_key: ${{ secrets.WAFPASS_API_KEY }}
          scan_path: ./infra
          iac_framework: terraform
          project: ${{ github.repository }}
          stage: ${{ github.ref_name == 'main' && 'prod' || 'dev' }}
          fail_on: high
          upload_source: true
Multi-cloud / monorepo example 
      - name: Run WAF++ PASS
        uses: WAF2p/wafpass-action@v0.1.1
        with:
          server_url: ${{ vars.WAFPASS_SERVER_URL }}
          api_key: ${{ secrets.WAFPASS_API_KEY }}
          scan_path: ./aws ./azure ./gcp
          iac_framework: terraform
          project: ${{ github.repository }}
          stage: ${{ github.ref_name == 'main' && 'prod' || 'dev' }}
          fail_on: high
          upload_source: true
Reference

Inputs & outputs

Everything the action accepts and returns, at a glance.

InputRequiredDefaultDescription
server_urlyes—Base URL of the WAF++ server.
api_tokenno—Bearer token. Provide either this or api_key.
api_keyno—Ingest API key (X-Api-Key).
scan_pathyes.Path(s) to scan. Separate multiple paths with spaces.
iac_frameworknoterraformIaC plugin: terraform, bicep, cdk, pulumi.
stageno—Deployment stage, e.g. dev, staging, prod.
projectnorepo nameProject / repo identifier.
fail_onnofailfail, skip, any, low, medium, high, critical, never.
upload_sourcenofalseUpload source files for dashboard diff previews.
fetch_controlsnofalseClone controls from the framework repo before scanning.
OutputDescription
run_idUUID of the created run on the WAF++ server.
scoreOverall compliance score returned by the server.
findings_countNumber of findings in the scan result.
Ready to automate?

Add WAF++ PASS to your pipeline.

Install the action from the GitHub Marketplace, copy the workflow, and start surfacing infrastructure compliance on every PR.

Get the action → About WAFPass Install WAFPass