0x1adi/Klarion Secret Scan
AI-native secret scanner — Rényi entropy speed, LLM judgment.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Aug 9, 2026
- License
- MIT
Pinned Snippet
uses: 0x1adi/klarion@620d697a6f95059f08b41e685d4afeceb23dd8fd # v0.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path (file or directory) to scan. | no | . |
| config | Path to a .klarion.toml config file. Empty = auto-discover. | no | "" |
| fail-on-severity | Minimum severity that fails the run (low|medium|high|critical). | no | low |
| ai-mode | AI verification mode (auto|on|off). Klarion requires a model to work; 'on' fails the run when no verifier can be built, and is recommended. 'auto' degrades to entropy-only output with a warning when no key is present. 'off' disables adjudication entirely and is for debugging the detection stage, not for scanning. | no | auto |
| sarif-file | Path to write the SARIF report to. | no | klarion.sarif |
| upload-sarif | Upload the SARIF report to GitHub code scanning (true|false). Requires the calling job to grant `permissions: security-events: write`. | no | true |
| anthropic-api-key | API key for the LLM verifier. Pass secrets.ANTHROPIC_API_KEY. Required for ai-mode: on; without it ai-mode: auto degrades to heuristic-only. | no | "" |
| args | Additional raw arguments passed through to `klarion scan`. | no | "" |
| scan-mode | What to scan. "auto" (default) follows the industry convention: on a pull_request it scans only the commits the PR adds, and on push/schedule/ manual runs it scans the whole tree. "diff" forces range scanning, "full" forces a working-tree scan, "history" audits all reachable commits. | no | auto |
| base | Base revision for diff scanning. Defaults to the pull request's base SHA. Ignored unless the run resolves to diff mode. | no | "" |
| head | Head revision for diff scanning (default: HEAD). | no | "" |
| cache | Persist AI verdicts between runs so unchanged code is never re-adjudicated (true|false). Uses the Actions cache; keyed per provider+model. The stored file holds only a one-way hash per candidate plus a status — no secrets and no model prose. | no | true |
| cache-path | Where the verdict ledger lives, relative to the workspace. | no | .klarion/verdicts.json |
| baseline-file | Path to a committed baseline of accepted findings (see `klarion baseline create`). Findings in it are suppressed, which is how a repository with pre-existing leaks adopts Klarion without a flag day. | no | "" |
| version | Klarion release tag to install (e.g. v0.1.0), or "latest" for the newest release. Defaults to the tag this action was pinned at, so `uses: 0x1Adi/Klarion@v1.2.3` runs the v1.2.3 scanner. | no | "" |
Outputs
no outputs