GuardDiff/action.yml at main · TKY-27/GuardDiff · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
name: GuardDiff
description: Block risky AI-generated diffs before they merge.
author: guarddiff

branding:
  icon: shield
  color: red

inputs:
  fail-on:
    description: Fail when findings are at or above this severity (critical/high/medium/low/info).
    required: false
    default: high

  post-comment:
    description: Post or update a pull request comment with the GuardDiff summary.
    required: false
    default: "true"

  sarif:
    description: Write SARIF output for GitHub Code Scanning.
    required: false
    default: "false"

  annotations:
    description: Emit GitHub workflow annotations for active findings.
    required: false
    default: "true"

  rules-update-check:
    description: Compare installed rule versions with the published registry and emit update notices.
    required: false
    default: "true"

  allow-rule-packs:
    description: Allow loading executable rule packs from guarddiff.config.yaml. Enable only for trusted branches.
    required: false
    default: "false"

  allow-inline-suppressions:
    description: Allow inline guarddiff-ignore suppressions in pull request diffs. Keep disabled for untrusted PRs.
    required: false
    default: "false"

  rules-registry-url:
    description: JSON manifest URL used for rule update checks.
    required: false
    default: https://raw.githubusercontent.com/TKY-27/GuardDiff/main/docs/site/rules/manifest.json

  sarif-file:
    description: Path for the SARIF output file.
    required: false
    default: guarddiff-results.sarif

  config:
    description: Path to the GuardDiff config file.
    required: false
    default: guarddiff.config.yaml

outputs:
  findings-count:
    description: Number of active findings, excluding suppressed findings.

  critical-count:
    description: Number of active critical findings.

  rule-update-count:
    description: Number of available rule updates.

  passed:
    description: Whether the configured policy passed.

runs:
  using: node20
  main: integrations/github-action/dist/main.js