antonellof/s0-cli security scan

LLM agent that runs SAST scanners + AI-slop detectors, triages every finding, and uploads SARIF to code scanning.

Trust Signals

workflow.ymlSHA-pinned

uses: antonellof/s0-cli@687ecfab27024b706eb1ec1744b3b06c669dfa83 # v0.3.3

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
mode	Scan mode: repo, diff, or file.	no	repo
diff-ref	Git ref to diff against when mode=diff (default: PR base, else origin/main).	no	""
path	Path to scan, relative to the workspace.	no	.
harness	Inner harness name (default: configured baseline).	no	""
no-llm	Skip the LLM and use raw scanner findings only. Free, deterministic.	no	false
fail-on	Exit non-zero if a finding meets this severity (info/low/medium/high/critical).	no	high
upload-sarif	Upload the SARIF report to GitHub code scanning. Requires `security-events: write`.	no	true
sarif-output	Path to write the SARIF report.	no	s0-results.sarif
model	LiteLLM model identifier (overrides repo default; e.g. openai/gpt-4o-mini).	no	""
s0-version	s0-cli version/git ref to install (PyPI version or git ref). Default: latest from main.	no	main
openai-api-key	OpenAI API key. Mutually exclusive with anthropic/gemini keys.	no	""
anthropic-api-key	Anthropic API key.	no	""
gemini-api-key	Google Gemini API key.	no	""

name	description
sarif-path	Path to the SARIF file written by the scan.
findings-count	Number of findings in the SARIF report (0 if none).