1-3-7/disrobe
Download the disrobe release binary, deobfuscate/decompile a path or glob, and upload the SARIF to GitHub code scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- None
Pinned Snippet
uses: 1-3-7/disrobe@61df80913b072beb257fb1dd249b53ce96551814 # v0.10.4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | File, directory, or glob to analyze. Passed verbatim to the disrobe command. | yes | — |
| command | disrobe subcommand to run (for example `auto`, `scan`, `behavior`). | no | auto |
| args | Extra arguments appended after the command and before the path (for example `--max-depth 12`). | no | "" |
| version | disrobe release tag to download (for example `v0.10.0` or `latest`). Defaults to this action's own ref, then `latest`. | no | "" |
| fail-on | Fail the step when the chain verdict is at or above this threshold. One of `never`, `incomplete`, `failed`, `any`. | no | never |
| sarif-file | Path the action writes the aggregated SARIF to. | no | disrobe.sarif |
| out-dir | Directory disrobe writes its recovered artifacts into. | no | disrobe-out |
| upload-sarif | Upload the SARIF to GitHub code scanning via github/codeql-action/upload-sarif. | no | true |
| upload-artifact | Upload the recovered-artifact directory as a workflow artifact. | no | true |
| token | GitHub token used to download the release asset (defaults to the workflow token). | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| sarif | Path to the SARIF file the action produced. |
| summary | One-line human-readable summary of the run. |
| verdict | Worst chain verdict observed across analyzed inputs. |