44aayush/tf-eu-guard

EU compliance security linter for Terraform (source, plan JSON) and Kubernetes (NIS2 + GDPR)

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Aug 30, 2026
License
MIT

Pinned Snippet

workflow.ymlSHA-pinned
uses: 44aayush/tf-eu-guard@0753570541bb9a7bb6a17a40a4143ffeaeac57ce # no releases — HEAD as of 2026-08-31

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
pathPath to the IaC directory (or, for iac-type: terraform_plan, the "terraform show -json" plan file), relative to the repository rootyes./terraform
outputReport format (dev, security, auditor, json, sarif, all). sarif writes tf-eu-guard.sarif into the workspace for GitHub Code Scanningnojson
iac-typeIaC language to scan: terraform, terraform_plan (pass the plan file path as path), or kubernetes — mirrors the CLI --iac-type flagnoterraform
frameworkFramework filter (nis2, gdpr, all)noall
fail-on-severityFail the workflow if findings at or above this severity exist (CRITICAL, HIGH, MEDIUM, LOW, INFO); empty disables gatingnoHIGH
upload-reportsUpload the generated HTML report(s) as a workflow artifact when output includes dev/security/auditor (or all)nofalse
upload-sarifUpload the SARIF output to GitHub Code Scanning (the workflow needs security-events: write permission). Only applies when output is sarifnofalse

no outputs