barbaria888/Supply Chain Guardian AI
Autonomous CVE detection & AI-driven Dockerfile remediation. Scans container images with Trivy, patches vulnerabilities using local Ollama or cloud LLMs, validates in KinD, and opens a PR with proof.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 18, 2026
- License
- None
Pinned Snippet
uses: barbaria888/supplychain-guardian-ai-github_action@4335568bc16445a9c0d5af572fadfde75ec34d6b # v2.1.3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| dockerfile | Path to the Dockerfile to scan and patch | no | Dockerfile |
| image-ref | Pre-built image to scan (skips dockerfile build) | no | "" |
| severity | Trivy severity filter (comma-separated) | no | CRITICAL,HIGH |
| provider | LLM provider: ollama (local) or openai (any compatible API) | no | ollama |
| model | Model name (e.g., llama3.2:1b, deepseek-ai/deepseek-v4-flash) | no | "" |
| api-key | API key for cloud providers. Not needed for ollama. | no | "" |
| openai-endpoint | OpenAI-compatible base URL (e.g., https://integrate.api.nvidia.com/v1) | no | https://integrate.api.nvidia.com/v1 |
| trivy-version | Trivy version | no | 0.55.0 |
| kind-enabled | Run KinD cluster validation after smoke test | no | true |
| kind-config | Path to KinD cluster config | no | .kind/cluster-config.yaml |
| k8s-manifests | Path to Kubernetes manifests directory | no | k8s/ |
| create-pr | Auto-create a Pull Request with the fix | no | true |
| pr-branch | Branch name for the remediation PR | no | auto-patcher/cve-remediation |
| pr-labels | Comma-separated PR labels | no | security,automated-patch,supply-chain-guardian |
| fail-on-vulnerability | Fail if CVEs are found and cannot be patched | no | true |
| llm-timeout | LLM inference timeout in seconds | no | 300 |
| policy-preset | Enforcement mode: strict (fail on any issue) or lax (warn and continue) | no | strict |
| enforce-non-root | If true, the integrity gate will reject Dockerfiles running as root. Set to false to allow root execution. | no | true |
| healthz-port | Host port mapped to the container for the health check | no | 18080 |
| healthz-path | Endpoint route path for the health check probe | no | / |
Outputs
| name | description |
|---|---|
| vulnerabilities-found | Whether CRITICAL/HIGH CVEs were found |
| patch-applied | Whether the AI generated a valid patch |
| smoke-test-passed | Whether the patched Dockerfile compiled and ran |
| kind-validation-passed | Whether KinD deployment succeeded |
| pr-url | URL of the created Pull Request |
| trivy-results-path | Path to Trivy scan results |
| audit-log-path | Path to the LLM audit log |