0xsj/Pathfinder Trust Chain Scanner
Map AWS trust chains, detect privilege escalation paths, and gate deployments on trust posture
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 13, 2026
- License
- None
Pinned Snippet
uses: 0xsj/pathfinder@8531b7f2f7b7cced79056d60d14fac821a58066e # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Pathfinder version to install (default: latest) | no | latest |
| command | Pathfinder command to run (scan, trace, diff, remediate) | no | scan |
| fail-on | Fail if any finding at or above this severity (critical/high/medium/low/info) | no | "" |
| min-severity | Only report findings at or above this severity | no | "" |
| format | Output format (sarif, json, table, markdown, csv, html, junit) | no | sarif |
| baseline | Path to baseline file for suppressing known findings | no | "" |
| regions | AWS regions to scan (comma-separated) | no | "" |
| profile | AWS profile name | no | "" |
| concurrency | Max parallel operations during discovery | no | "" |
| scp-file | Path to SCP policies JSON file | no | "" |
| rules | Path to custom analysis rules JSON file | no | "" |
| extra-args | Additional pathfinder CLI arguments | no | "" |
| upload-sarif | Upload SARIF results to GitHub Code Scanning | no | true |
| comment | Post a PR comment with findings summary | no | true |
| github-token | GitHub token for SARIF upload and PR comments | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| chains | Number of trust chains discovered |
| findings | Number of security findings |
| max-severity | Highest severity found (CRITICAL/HIGH/MEDIUM/LOW/INFO or NONE) |
| passed | Whether the check passed (true/false) |
| sarif-file | Path to SARIF output file (if format=sarif) |
| json-file | Path to JSON output file (always generated for summary) |