a-y-ibrahim/unicode-shield scan
Scan files for dangerous Unicode (bidi spoofing, invisible characters, homoglyphs, Zalgo text) and annotate findings inline on the commit or pull request.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Aug 15, 2026
- License
- MIT
Pinned Snippet
uses: a-y-ibrahim/unicode-shield@b10da0706b6c6eae2368ace848632d2b140b8a36 # v0.9.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | File or directory to scan. | no | . |
| version | unicode-shield version to run, as an npm version or tag (e.g. 'latest', '0.7.0', '~0.7.0'). | no | latest |
| fail-on-threat | Whether a dangerous threat fails this step. Set to 'false' to only annotate without failing the job. | no | true |
| sarif | Set to 'true' to also upload results to the repository's Security > Code scanning tab (a persistent, trackable alert, not just a PR annotation), via github/codeql-action/upload-sarif. Requires the calling job to grant `permissions: security-events: write` (and, on a private repository, `actions: read` too). | no | false |
| category | Passed straight through to upload-sarif's own 'category' input when 'sarif' is 'true'; unused otherwise. Set this to something distinct per call whenever this action runs more than once for the same commit (a build matrix, or scanning more than one path in one workflow), otherwise later uploads silently replace earlier ones in the Security tab instead of being tracked separately. | no | "" |
Outputs
| name | description |
|---|---|
| safe | 'true' if no dangerous threats were found, 'false' otherwise. |
| threat-count | Total number of threats found (dangerous and informational). |
| sarif-path | Path to the generated SARIF file, only set when 'sarif' is 'true'. |