1-3-7/disrobe

Download the disrobe release binary, deobfuscate/decompile a path or glob, and upload the SARIF to GitHub code scanning.

Trust Signals

workflow.ymlSHA-pinned

uses: 1-3-7/disrobe@61df80913b072beb257fb1dd249b53ce96551814 # v0.10.4

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
path	File, directory, or glob to analyze. Passed verbatim to the disrobe command.	yes	—
command	Top-level disrobe subcommand to run. Put any nested subcommand and its flags in args.	no	auto
args	Extra arguments appended after the command and before the path (for example `--max-depth 12`).	no	""
version	disrobe release tag to download (for example `v0.10.0` or `latest`). Defaults to this action's own ref, then `latest`.	no	""
fail-on	Fail the step when the chain verdict is at or above this threshold. One of `never`, `incomplete`, `failed`, `any`. The verdict comes from the chain recovery report, not from the number of SARIF findings, so a clean chain that reported a secret stays `ok`.	no	never
sarif-file	Path the action writes the aggregated SARIF to.	no	disrobe.sarif
out-dir	Output path passed to apk, auto, bug-report, chain, context, extract, man, report, and webview.	no	disrobe-out
upload-sarif	Upload the SARIF to GitHub code scanning via github/codeql-action/upload-sarif.	no	true
upload-artifact	Upload the recovered-artifact directory as a workflow artifact.	no	true
token	GitHub token used to download the release asset (defaults to the workflow token).	no	${{ github.token }}

name	description
sarif	Path to the SARIF file the action produced.
summary	One-line human-readable summary of the run.
verdict	Worst chain verdict observed across analyzed inputs, graded to `ok`, `incomplete` or `failed`.
chain-verdict	The chain verdict itself, before grading, for example `complete`, `stalled` or `cap-reached`.