0ryant/taudit pipeline authority gate
Gate risky CI/CD authority paths before they reach main.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 8, 2026
- License
- None
Pinned Snippet
uses: 0ryant/taudit-action@bff5d26f1201b349f088bcc755a479466f961379 # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | taudit command mode: verify, scan, or graph. | no | verify |
| version | Exact taudit CLI version to install. | no | 1.1.5 |
| paths | Newline-separated pipeline paths or globs. | no | .github/workflows/ |
| platform | Pipeline platform: auto, github-actions, azure-devops, gitlab, or bitbucket. | no | auto |
| ado-org | Optional Azure DevOps organization for variable-group enrichment. | no | — |
| ado-project | Optional Azure DevOps project for variable-group enrichment. | no | — |
| ado-pat | Optional read-only Azure DevOps PAT for variable-group enrichment. | no | — |
| policy | Invariant policy file or directory. Required for verify. | no | — |
| include-builtin | Run taudit built-in rules in verify mode. | no | false |
| ignore-file | Optional explicit .tauditignore path. | no | — |
| suppressions | Optional explicit .taudit-suppressions.yml path. | no | — |
| suppression-mode | Suppression behavior: downgrade or tag-only. | no | downgrade |
| baseline-root | Repository root containing .taudit/baselines/. | no | — |
| gate-on-all | Ignore baseline-new-only gating and gate on all findings. | no | false |
| strict | Fail verify on discovered-file parse/read errors. | no | false |
| ignore-partial | Suppress findings produced by partial-graph reasoning. | no | false |
| format | Mode-specific output format. | no | — |
| output | Optional report/graph output path. | no | — |
| graph-view | Graph projection: authority or exploit. | no | authority |
| severity-threshold | Minimum severity: critical, high, medium, low, or info. | no | — |
| max-hops | Maximum authority propagation depth. | no | — |
| no-color | Disable ANSI color in taudit text output. | no | true |
| fallback-cargo | Use cargo install fallback if release asset resolution is unavailable. | no | false |
Outputs
| name | description |
|---|---|
| exit-code | taudit process exit code. |
| outcome | pass, violations, or config-error. |
| report-path | Output report path, if written. |
| graph-path | Output graph path, if written. |
| findings-count | Finding count parsed from machine output where available. |
| policy-path | Policy path used for verify. |
| ignore-file-used | Explicit or discovered ignore file, if known. |
| suppressions-file-used | Explicit or discovered suppressions file, if known. |
| suppression-mode-used | downgrade or tag-only. |
| baseline-root-used | Baseline root used for scan/verify. |
| baseline-status | found, missing, unused, or unknown. |
| partial-policy | normal or ignore-partial. |
| ado-enrichment | unused, configured, or failed. |
| new-findings-count | New finding count where available. |
| preexisting-critical-count | Pre-existing critical count where available. |
| waived-count | Suppressed/baseline-waived count where available. |
| taudit-version | Actual taudit version invoked. |