| api-url | AppSecAI API base URL. Leave unset unless AppSecAI Support provides a custom endpoint. | no | https://gh.cloud.appsecai.io |
| file | One SARIF, JSON, CSV, TSV, or XML file containing security scan results. Use either file or files, not both. | no | — |
| files | Comma- or newline-separated SARIF, JSON, CSV, TSV, or XML files to submit as one multi-SAST run. Supports simple * and ** glob patterns. | no | "" |
| update-context | Trigger fresh security context extraction before the scan | no | false |
| allow-missing-repo-access | Start the run even when the AppSecAI GitHub App cannot yet push to the target repository. Use this when the organization is licensed and the App is installed, but the specific repository simply has not been added to the App installation yet — the run starts now and remediation pull requests are delivered once the repository is granted to the App. When left at the default, the action fails fast with an actionable message if the App lacks push access. | no | false |
| pr-audience | Comma-separated ordered PR reviewer audiences to emphasize in generated remediation PR content, for example security,engineering | no | "" |
| regression-evidence-base-ref | Base git ref for regression evidence diff calculation | no | "" |
| regression-evidence-base-sha | Base git SHA for regression evidence diff calculation | no | "" |
| regression-evidence-head-ref | Head git ref for regression evidence diff calculation | no | "" |
| regression-evidence-head-sha | Head git SHA for regression evidence diff calculation | no | "" |
| regression-evidence-coverage-artifacts | Comma/newline separated coverage mapping artifact paths used for line-to-test matching | no | "" |
| regression-evidence-test-commands | Newline-separated test commands to execute for impacted test validation (supports {{tests}} template) | no | "" |
| regression-evidence-output-json-path | Output path for generated regression evidence JSON | no | regression-evidence.json |
| regression-evidence-output-markdown-path | Output path for generated regression evidence markdown summary | no | regression-evidence.md |
| regression-evidence-allow-partial | Allow partial status when some changed lines are uncovered | no | true |
| regression-evidence-fail-on-at-risk | Fail the action when computed status is at_risk | no | false |
| regression-evidence-publish-comment | Publish or update a single marker-based PR comment with regression evidence summary | no | false |