alexpermiakov/SAST Triage
Triage SAST findings (SARIF 2.1.0) with a bounded LLM agent and an evidence-keyed verdict cache.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| provider | LLM API shape: anthropic for Claude's native API, openai for anything OpenAI-compatible. Leave empty (the default) and base-url selects it for you | — | "" |
| model | Model name — always required (e.g. claude-sonnet-5 for anthropic, qwen2.5-coder:7b for openai) | yes | — |
| base-url | OpenAI-compatible API base URL; required when provider is openai (e.g. http://localhost:11434/v1). No default: the tool only ever talks to the endpoint you name | — | "" |
| api-key | API key for whichever provider is selected — routed to ANTHROPIC_API_KEY or OPENAI_API_KEY to match. Self-hosted endpoints need none. Prefer this over the provider-specific inputs below | — | "" |
| anthropic-api-key | Provider-specific alternative to api-key, for provider: anthropic. Wins over api-key when both are set | — | "" |
| openai-api-key | Provider-specific alternative to api-key, for hosted OpenAI-compatible endpoints. Wins over api-key when both are set | — | "" |
| sarif-file | SARIF 2.1.0 input produced by your scanner | — | findings.sarif |
| repo | Repository root the findings refer to | — | . |
| scope | What to triage: full (every finding in the SARIF) or diff (only findings in files changed since base-ref). Set it from your trigger — pull_request wants diff, schedule and workflow_dispatch want full. Never inferred. | — | full |
| base-ref | Base to diff against when scope is diff, e.g. origin/main. Needs fetch-depth: 0 on checkout | — | "" |
| mode | Whether this run can fail the build: enforce (exit 3 on exploitable findings in scope), report (advisory), or baseline (triage everything, gate nothing — seeding a fresh cache). | — | enforce |
| cache-write | What to do with the updated cache: branch (commit to the branch being built — use on PRs), pr (open/refresh one review PR — use when seeding), or none (artifact only). Fork PRs cannot push, and fall back to none automatically. | — | none |
| cache | Verdict cache file (commit it to git) | — | .sast-triage/cache.json |
| report | Markdown report output (complete; no size cap) | — | triage-report.md |
| digest | Byte-bounded digest of the report, safe to publish to the step summary (1 MiB cap) or a PR/issue body (65,536 chars). Empty = skip. | — | triage-digest.md |
| digest-bytes | Size cap for the digest; overflow is dropped by priority (benign first, exploitable last) | — | 50000 |
| summary | Run headline plus one bounded verdict table (15 rows max). Used verbatim as the seed PR body, which sits above a cache diff carrying every verdict in full. Empty = skip. | — | triage-summary.md |
| triaged-sarif | Verdict-annotated copy of the input SARIF — benign findings gain a SARIF suppression, nothing is ever deleted. Upload it to Code Scanning or feed it to DefectDojo. On by default; empty = skip. | — | triaged.sarif |
| effort | Triage depth per finding: small | medium | large | xlarge | — | medium |
| max-findings-budget | Max findings triaged by LLM per run (0 = unlimited) | — | 50 |
| parallel | Findings triaged concurrently | — | 4 |
| create-issues | File GitHub issues for exploitable findings (needs an issues-writable token) | — | false |
| pr-comments | Post exploitable verdicts as inline comments on the PR diff (needs pull-requests: write). Auto-detects the PR number on pull_request triggers. | — | false |
| github-repo | owner/name for issue creation; defaults to the current repository | — | "" |
| github-token | Token used for issue creation when create-issues is true | — | ${{ github.token }} |
| link-base | Base URL for clickable evidence links, e.g. https://github.com/owner/repo/blob/<sha> | — | "" |
| extra-args | Extra CLI flags appended verbatim, e.g. "-max-iterations 15 -issue-label security" | — | "" |
Outputs
no outputs