Compliance in your pipeline.

Add WOMBATpass to any workflow. Scan Terraform, Bicep, CDK, or Pulumi on every pull request and push, then send the full result payload to your WOMBATpass server for dashboards, gap analysis, and audit evidence.

Get the action View on GitHub Install WOMBATpass Share your score

Terraform Bicep CDK Pulumi Bearer token API key Fail policies

v0.1.1

Action release

IaC frameworks

Auth modes

Cloud credentials needed

One step. Full visibility.

The action handles CLI installation, scanning, result upload, and policy enforcement so your team can focus on shipping.

Auto-install CLI

Installs the latest wafpass-core from PyPI automatically, or override with a custom pip source or pre-installed binary.

Multi-IaC scan

Scan Terraform, Bicep, CDK, or Pulumi files in a single step. Supports multiple paths and Terraform plan JSON for change overview.

Push to server

Uploads the full wafpass-result.json payload to POST /api/v1/runs so dashboards and evidence packages stay current.

Policy gates

Configurable fail_on policies from never to critical. Fail the step after the result is safely stored on the server.

Flexible auth

Use a Bearer token for interactive users or an ingest API key for headless CI/CD runs. Both forwarded securely to the server.

CI/CD metadata

Marks runs as is_cicd: true with triggered_by: github-actions, and passes branch, commit SHA, project, and stage automatically.

Add it to any workflow.

Check out your repo, run the action, and surface compliance results where your team already works.

.github/workflows/wafpass.yml

name: WOMBATpass Scan

on:
  push:
    branches: [main, develop]
  pull_request:

jobs:
  wafpass:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run WOMBATpass
        uses: WAF2p/wafpass-action@v0.1.1
        with:
          server_url: ${{ vars.WAFPASS_SERVER_URL }}
          api_key: ${{ secrets.WAFPASS_API_KEY }}
          scan_path: ./infra
          iac_framework: terraform
          project: ${{ github.repository }}
          stage: ${{ github.ref_name == 'main' && 'prod' || 'dev' }}
          fail_on: high
          upload_source: true

Multi-cloud / monorepo example

      - name: Run WOMBATpass
        uses: WAF2p/wafpass-action@v0.1.1
        with:
          server_url: ${{ vars.WAFPASS_SERVER_URL }}
          api_key: ${{ secrets.WAFPASS_API_KEY }}
          scan_path: ./aws ./azure ./gcp
          iac_framework: terraform
          project: ${{ github.repository }}
          stage: ${{ github.ref_name == 'main' && 'prod' || 'dev' }}
          fail_on: high
          upload_source: true

Inputs & outputs.

Everything the action accepts and returns, at a glance.

Inputs

Input	Required	Default	Description
`server_url`	yes	none	Base URL of the Wombat server.
`api_token`	no	none	Bearer token. Provide either this or `api_key`.
`api_key`	no	none	Ingest API key (`X-Api-Key`).
`scan_path`	yes	`.`	Path(s) to scan. Separate multiple paths with spaces.
`iac_framework`	no	`terraform`	IaC plugin: `terraform`, `bicep`, `cdk`, `pulumi`.
`stage`	no	none	Deployment stage, e.g. `dev`, `staging`, `prod`.
`project`	no	repo name	Project / repo identifier.
`fail_on`	no	`fail`	`fail`, `skip`, `any`, `low`, `medium`, `high`, `critical`, `never`.
`upload_source`	no	`false`	Upload source files for dashboard diff previews.
`fetch_controls`	no	`false`	Clone controls from the framework repo before scanning.

Outputs

Output	Description
`run_id`	UUID of the created run on the Wombat server.
`score`	Overall compliance score returned by the server.
`findings_count`	Number of findings in the scan result.

Rules that read like intent.

ALLOW, DENY, REQUIRE and LIMIT — the same ruleset engine the CLI runs, applied on every pull request.

Wombat at a workbench with allow, deny, require and limit rule modules

Add WOMBATpass to your pipeline.

Install the action from the GitHub Marketplace, copy the workflow, and start surfacing infrastructure compliance on every PR.

Get the action About WOMBATpass Install WOMBATpass