andrewmw94/Tandem Security Analysis
Submit a repository to Tandem and report command-injection findings in CI.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| api-key | Customer API key for Tandem. | yes | — |
| api-url | Base URL for the Tandem analyses API. | no | https://api.cogitemus.com/v1/analyses |
| entrypoint | Optional repository-relative entrypoint. Tandem discovers package.json when omitted. | no | "" |
| fail-on-findings | Fail the workflow when command-injection paths are found. | no | false |
| poll-interval-seconds | Seconds to wait between status checks. | no | 5 |
| timeout-seconds | Maximum time to wait for an analysis. | no | 1800 |
| upload-artifact | Upload tandem-result.json as a workflow artifact. | no | true |
| artifact-name | Name of the uploaded result artifact. | no | tandem-analysis |
Outputs
| name | description |
|---|---|
| status | Final Tandem job status. |
| findings | Number of command-injection paths found. |
| job-id | Tandem analysis job ID. |
| result-file | Absolute path to the JSON result file. |