ayaanmaliksgithub/Virgil

Run a Virgil security audit on the calling repo. Self-hosted, sandboxed scanners + LLM triage + SARIF export.

Trust Signals

workflow.ymlSHA-pinned

uses: ayaanmaliksgithub/virgil@87cfc5a24f760ce16ecbc56a690456056fdfe37d # v0.5.0

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
path	Path to scan, relative to the caller's checkout. Defaults to the repo root.	no	.
fail-on	Exit non-zero when findings at this severity (or higher) are present. One of: never, critical, high, medium, low.	no	critical
anthropic-api-key	Optional Anthropic API key for LLM-enriched explanations, priority ranking, and chat. The audit runs deterministically without it (clustering, reachability, priority queue all work with the no-LLM fallback).	no	""
openai-api-key	Optional OpenAI API key, as an alternative to anthropic-api-key. If both are set, anthropic-api-key wins.	no	""
output-sarif	Path to write the SARIF artifact. Set to '' to skip.	no	virgil-findings.sarif
comment-pr	Post a sticky comment with the priority queue on the PR. Requires pull_request event.	no	true
virgil-ref	Git ref of the Virgil project to use. Defaults to the action's own ref.	no	""

name	description
audit-id	The Virgil audit ID for this run. Use for follow-up CLI calls.
sarif-path	Filesystem path to the SARIF artifact, if output-sarif was set.
exit-status	Final exit code from `virgil scan` (0 = under threshold, 1 = over, 2 = audit failed, 3 = api unreachable).