actions-marketplace-validations/Code-Pathfinder
Security scanning with Code-Pathfinder - an open-source CodeQL alternative
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Feb 9, 2026
- License
- AGPL 3.0
Pinned Snippet
uses: actions-marketplace-validations/shivasurya_code-pathfinder@0a08aa7fd15150b3fdbaf01fbf740599eba5cc47 # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| rules | Path to Python SDK rules file or directory | no | — |
| ruleset | Remote ruleset(s) to use (e.g., python/deserialization, docker/security). Can specify multiple comma-separated. | no | — |
| project | Path to source code to scan | no | . |
| output | Output format: sarif, json, or csv | no | sarif |
| output-file | Output file path (e.g., results.sarif) | no | pathfinder-results.sarif |
| fail-on | Fail with exit code 1 if findings match severities (e.g., critical,high) | no | "" |
| verbose | Enable verbose output | no | false |
| python-version | Python version to use | no | 3.12 |
| skip-tests | Skip scanning test files | no | true |
| refresh-rules | Force refresh of cached rulesets (bypasses cache) | no | false |
| debug | Enable debug diagnostics with timestamps | no | false |
| disable-metrics | Disable anonymous usage metrics collection | no | false |
| pr-comment | Post a summary comment on the pull request with scan results | no | false |
| pr-inline | Post inline review comments for critical/high severity findings | no | false |
| github-token | GitHub token for posting PR comments (required when pr-comment or pr-inline is enabled) | no | "" |
| no-diff | Disable diff-aware scanning (scan all files instead of only changed files) | no | false |
Outputs
| name | description |
|---|---|
| results-file | Path to the output results file |
| version | Installed pathfinder version |