abdulbasit742/Basit Agent System

Secure full, changed-file, or added-line repository scanning with PR annotations and SARIF output.

Trust Signals

workflow.ymlSHA-pinned

uses: abdulbasit742/ai-agent-system@dfcb5f35fa8d526db5fb02458f70bb73ccacc257 # no releases — HEAD as of 2026-07-16

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
mode	Scan mode: full, changed-files, or added-lines.	no	added-lines
path	Repository-relative directory to scan.	no	.
fail-on	Minimum severity that fails the action.	no	high
base-ref	Base Git ref or commit. Pull requests default to the exact event base SHA.	no	""
head-ref	Head Git ref or commit. Pull requests default to the exact event head SHA.	no	""
new-only	Compare against an exact-fingerprint baseline and fail only on new findings.	no	false
baseline	Optional repository-relative baseline path.	no	""
config	Optional repository-relative rule-pack configuration path.	no	""
policy	Optional repository-relative suppression-policy path.	no	""
annotations	Emit GitHub workflow annotations without matched source previews.	no	true
max-annotations	Maximum annotations emitted by one step, from 0 to 50.	no	10
report-path	JSON report path beneath .agent-system/.	no	.agent-system/action-report.json
sarif-path	SARIF report path beneath .agent-system/.	no	.agent-system/action-results.sarif
python-version	Python version used by the action.	no	3.12

name	description
status	passed, findings, or error.
finding-count	Number of reported findings.
suppressed-count	Number of suppressed findings.
new-count	Number of new findings in baseline mode.
existing-count	Number of existing findings in baseline mode.
resolved-count	Number of resolved findings in baseline mode.
report-path	Repository-relative JSON report path.
sarif-path	Repository-relative SARIF report path.