44aayush/tf-eu-guard

EU compliance security linter for Terraform (source, plan JSON) and Kubernetes (NIS2 + GDPR)

Trust Signals

workflow.ymlSHA-pinned

uses: 44aayush/tf-eu-guard@0753570541bb9a7bb6a17a40a4143ffeaeac57ce # no releases — HEAD as of 2026-08-31

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
path	Path to the IaC directory (or, for iac-type: terraform_plan, the "terraform show -json" plan file), relative to the repository root	yes	./terraform
output	Report format (dev, security, auditor, json, sarif, all). sarif writes tf-eu-guard.sarif into the workspace for GitHub Code Scanning	no	json
iac-type	IaC language to scan: terraform, terraform_plan (pass the plan file path as path), or kubernetes — mirrors the CLI --iac-type flag	no	terraform
framework	Framework filter (nis2, gdpr, all)	no	all
fail-on-severity	Fail the workflow if findings at or above this severity exist (CRITICAL, HIGH, MEDIUM, LOW, INFO); empty disables gating	no	HIGH
upload-reports	Upload the generated HTML report(s) as a workflow artifact when output includes dev/security/auditor (or all)	no	false
upload-sarif	Upload the SARIF output to GitHub Code Scanning (the workflow needs security-events: write permission). Only applies when output is sarif	no	false

no outputs