bokuweb/sakimori

eBPF/ETW audit & block for GitHub Actions (Linux + Windows)

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 4, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: bokuweb/sakimori@8491d10e50cf65e438bedb87cd6f4e496140ac29 # v0.34.4

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
policy	Path to the policy file (YAML or JSON).	no	.github/sakimori.yml
mode	audit \| block. Overrides `mode:` in the policy file.	no	audit
version	Sakimori release tag to install (e.g. v0.6.0). Defaults to whatever tag this action was referenced as; `latest` resolves the newest release.	no	""
log	Where the subsequent `sakimori run` step should write its JSON audit log.	no	sakimori.log.json
run	Optional shell script to supervise. If set, the action installs sakimori AND runs the script under `sakimori run` automatically — no separate step needed. On Linux the script is executed with `sudo -E env "PATH=$PATH" "$SAKIMORI_BIN" run … -- bash -euxo pipefail -c '<run>'`; on Windows with `& $env:SAKIMORI_BIN run … -- pwsh -NoProfile -Command "<run>"`. Leave empty (default) to keep the install-only behaviour and write the `sakimori run` invocation yourself in a later step.	no	""
html	Path to write the HTML report to (passed as `--html`). Only used when `run` is set.	no	sakimori-report.html
summary	Path the supervised run should append its step-summary markdown to (passed as `--summary`). Defaults to $GITHUB_STEP_SUMMARY. Only used when `run` is set.	no	""
snapshot-workspace	If set, passed as `--snapshot-workspace <path>` to take a workspace tamper-detection baseline before and after the supervised command. Only used when `run` is set.	no	""

Outputs

name	description
bin	Absolute path to the installed sakimori binary.
bpf	Absolute path to the installed sakimori.bpf.o (Linux only).