aram10/Dramaturge
Run Dramaturge exploratory QA engine against your web application
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 15, 2026
- License
- Apache 2.0
Pinned Snippet
uses: aram10/dramaturge@8dffc943b27607cff41884d526bd7ff3957c2c30 # dramaturge-v0.8.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| config | Path to Dramaturge config file | no | dramaturge.config.json |
| target-url | Target URL to test (overrides config value) | no | — |
| anthropic-api-key | Anthropic API key | no | — |
| openai-api-key | OpenAI API key | no | — |
| google-api-key | Google Generative AI API key | no | — |
| fail-on-severity | Fail the step if findings at or above this severity are found. Accepted values: critical, major, minor, trivial. Leave empty to never fail on findings. | no | "" |
| upload-report | Upload the report as a workflow artifact | no | true |
| post-comment | Post a summary comment on the PR | no | true |
| report-dir | Directory for report output (overrides config value) | no | "" |
| force-json-output | When true, the action explicitly overrides config.output.format to ensure a JSON report is available for parsing. A markdown-only config becomes both; an unset format becomes json. Set to false to preserve the configured output.format. Leave this enabled when you rely on finding-count, max-severity, PR comments, or fail-on-severity enforcement. | no | true |
| force-headless | When true, the action explicitly overrides config.browser.headless to true for the action run. Set to false to preserve the configured headless value. | no | true |
| working-directory | Working directory for running Dramaturge | no | . |
| node-version | Node.js version to use | no | 20 |
| dramaturge-version | Dramaturge package version to install (e.g. "0.1.0" or "latest") | no | latest |
| upload-sarif | When true, upload the generated SARIF report to GitHub Code Scanning. Requires the config output.format to include "sarif" and a file named report.sarif to be present in the report directory. | no | false |
Outputs
| name | description |
|---|---|
| report-path | Path to the generated report directory |
| finding-count | Total number of findings |
| max-severity | Highest severity level found (Critical, Major, Minor, Trivial, or none) |