boinger/Codebase Audit
Cold-start codebase audit powered by Claude Code. Finds bugs, security issues, architecture problems, tech debt, and test gaps.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 9, 2026
- License
- MIT
Pinned Snippet
uses: boinger/zorille@8ec4e943de57bf5cc78fb4c895e0cf091bd38a09 # v1.12.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| anthropic-api-key | Anthropic API key for Claude | yes | — |
| fail-on | Fail threshold: critical (default) or important | no | critical |
| format | Output format: json (default) or sarif | no | json |
| changed-only | Scope audit to files changed in this PR/branch | no | false |
| baseline-only | Establish baseline without failing (for CI onboarding) | no | false |
| fail-on-new | Fail only on new findings vs previous baseline | no | false |
| fail-on-regression | Also fail if health score regressed | no | false |
| min-severity | Filter findings to this severity and above: critical, important, notable | no | "" |
| no-infra | Skip infrastructure scanning | no | false |
| upload-sarif | Auto-upload SARIF to GitHub Code Scanning (requires security-events: write) | no | true |
| sarif-category | Category for SARIF upload (disambiguates multiple analysis tools) | no | codebase-audit |
| cache-baseline | Persist baselines across runs via actions/cache | no | true |
| claude-code-version | Claude Code CLI version to install (default: latest) | no | latest |
| extra-flags | Additional flags passed directly to /codebase-audit | no | "" |
Outputs
| name | description |
|---|---|
| status | Audit result: pass or fail |
| health-score | Codebase health score (0-100) |
| findings-count | Number of findings |
| sarif-file | Path to SARIF file (when format=sarif) |