agnivasengupta/CodeScan Security Gate
Scans PRs for vulnerabilities and posts fix suggestions, gated on .codescan.yml thresholds.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 7, 2026
- License
- None
Pinned Snippet
uses: agnivasengupta/grepvf-action-test@1067c54970b91d35cd9fe3d1febc62102ec4ba9f # v1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | Token used to post PR comments and upload SARIF. Defaults to the workflow's own token. | yes | ${{ github.token }} |
| fail-on | Severity that blocks the check: critical | high | medium | none. Overridden by .codescan.yml if present. | no | critical |
| config-path | Path (relative to the consumer repo root) to the .codescan.yml config file. | no | .codescan.yml |
| image-tag | Override the engine image tag (advanced — most consumers should leave this at v1). | no | v1 |
| llm-api-key | API Key for the LLM Triage and Patcher engines. | yes | — |
| llm-api-url | API URL for the LLM (e.g. https://api.groq.com/openai/v1/chat/completions). | no | https://api.groq.com/openai/v1/chat/completions |
| llm-model | The name of the LLM model to use for patching (e.g. llama-3.1-8b-instant). | no | llama-3.1-8b-instant |
| llm-triage-model | The name of the LLM model to use for triage (if different from llm-model). | no | llama-3.1-8b-instant |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings after deduplication. |
| critical-count | Number of unresolved CRITICAL-severity findings. |
| sarif-path | Path to the generated SARIF report, relative to the workspace. |