autocyber-ai/CRP Scan

Detect ungoverned AI calls, missing safety policies, and audit gaps. Uploads SARIF to GitHub Security tab.

Trust Signals

workflow.ymlSHA-pinned

uses: autocyber-ai/crp-scan@5075aea05a92663aacfdf86d2de463ef06d59a0f # vscode-v0.3.1

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
paths	Comma-separated paths to scan. Defaults to the entire repository ('.').	no	.
fail-on	Minimum severity that causes a non-zero exit code (LOW \| MEDIUM \| HIGH \| CRITICAL). Default HIGH.	no	HIGH
format	Console output format: text \| json \| markdown \| sarif \| junit.	no	text
upload-sarif	Upload SARIF results to the GitHub Security tab. Requires the security-events: write permission.	no	true
summary	Append a markdown summary of findings to the GitHub Actions step summary ($GITHUB_STEP_SUMMARY).	no	true
min-version	Minimum crprotocol version to enforce (e.g. '4.0.0').	no	""
min-grounding	Minimum required grounding score for policy lint (0.0–1.0).	no	0.0
report-only	When 'true', report findings but always exit 0 (never fail the build).	no	false
auto-remediate	v4: When 'true', open a remediation PR for HIGH+ findings. Requires contents: write permission and a GitHub token. NEVER commits to the default branch directly — always opens a PR.	no	false
remediation-branch-prefix	Branch prefix for auto-remediation PRs. Default 'crp-scan/fix'.	no	crp-scan/fix
python-version	Python version to install crprotocol with. Defaults to '3.11'.	no	3.11
crprotocol-version	crprotocol package version to install. Leave blank for latest. NOTE: crp scan v4 features require crprotocol >= 4.0.0	no	""

name	description
sarif-file	Path to the generated SARIF file (if upload-sarif is true).
findings-count	Total number of findings found.
highest-severity	Highest severity finding (NONE \| LOW \| MEDIUM \| HIGH \| CRITICAL).
remediation-pr-url	URL of the opened remediation PR (if auto-remediate is true).