abimanyu-a/P4 security gate
Scan a repo with P4's Prepare -> Scan -> Validate pipeline and fail the build on confirmed, LLM-validated vulnerabilities. Uploads results as SARIF for GitHub code scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Aug 19, 2026
- License
- None
Pinned Snippet
uses: abimanyu-a/p4@13f7d2c6ba5ada7826e7f2f6ae9e5b7d64b82e5f # no releases — HEAD as of 2026-08-29tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to the repo to scan, relative to the caller's workspace. | no | . |
| gemini-api-key | Gemini API key used by the Validate/Prove stages. Required unless skip-validate is true. | no | — |
| fail-on | 'confirmed' (default) fails the step on any confirmed finding; 'none' always exits 0 (report-only). | no | confirmed |
| min-severity | Only gate/report findings at or above this severity: low, medium, high, critical. | no | low |
| skip-validate | Run Prepare+Scan only, no LLM calls and no API key required. Cannot gate on confirmed findings in this mode — use for smoke-testing the wiring. | no | false |
| baseline-commit | Only report findings not already present at this commit (diff-aware scanning), so adopting P4 in a repo with pre-existing findings doesn't fail every PR. Defaults to the PR's base commit on pull_request events; pass '' explicitly to force a full scan. The checkout step needs `fetch-depth: 0` (or at least enough history to reach this commit) for it to be found. | no | "" |
Outputs
| name | description |
|---|---|
| sarif-path | Path to the generated SARIF report. |
| exit-code | Exit code from `p4 scan` (0 = pass, 1 = gate failure, 2 = error). |