angadjosan/Sentinel Security Scan
Sentinel scans your pull requests in your own CI — your source code never leaves the runner. Only finding metadata (SARIF/JSON) is emitted and, optionally, POSTed to your Sentinel cloud. Uploads results to GitHub code scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- Apache 2.0
Pinned Snippet
uses: angadjosan/sentinel@6340cb2ec68a5eeb71aa3bffbdc4ab3a4aa54a7e # v0.2.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| repo-name | Logical repo name (owner/repo) recorded with findings. | no | ${{ github.repository }} |
| provider | LLM provider: anthropic | openai | local | mock. 'mock' runs secrets + SCA only (no LLM, no key required). | no | mock |
| model | Model name (e.g. claude-sonnet-4-6, gpt-4o). Empty = provider default. | no | "" |
| api-key | LLM API key for the chosen provider. Leave empty for 'mock'/'local'. | no | "" |
| llm-endpoint | Custom LLM endpoint URL (e.g. an Ollama server for provider 'local'). | no | "" |
| base-ref | Base git ref/SHA for the diff. Empty = auto-detect from the event (PR base sha, push 'before' sha, or origin/<default-branch>). | no | "" |
| fail-on | Fail the job if any finding is at/above this severity: info|low|medium|high|critical|none. | no | high |
| sarif | Path to write the SARIF 2.1.0 report. | no | sentinel.sarif |
| upload-sarif | Upload the SARIF report to GitHub code scanning (requires security-events: write). | no | true |
| ingest-url | Sentinel cloud API base URL. If set, findings (NOT source) are POSTed to {url}/findings/ingest. | no | "" |
| ingest-token | Bearer token for --ingest-url. | no | "" |
| python-version | Python version used to run the scanner (requires 3.12+). | no | 3.12 |
| working-directory | Path to the git checkout to scan. | no | . |
Outputs
no outputs