astrolexisai/KCode Audit
Run KCode's deterministic security audit and upload SARIF to GitHub code scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 26, 2026
- License
- Apache 2.0
Pinned Snippet
uses: astrolexisai/kcode@23ec3bb64cb7f8b2bd955df49bc12bb23feed120 # v2.10.466tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to audit (repo root by default) | no | . |
| model | Override the verification model (default: reads from settings) | no | — |
| api-key | API key for the verification model (if not set, uses env/settings) | no | — |
| skip-verify | Skip LLM verification — static regex stage only. Faster but higher FP rate. | no | false |
| max-files | Maximum files to scan | no | 500 |
| fail-on-severity | Fail the action if any finding at or above this severity is CONFIRMED (none|low|medium|high|critical) | no | high |
Outputs
| name | description |
|---|---|
| sarif-path | Path to the generated .sarif file (relative to GITHUB_WORKSPACE) |
| confirmed-findings | Number of CONFIRMED findings produced by the audit |