brandonjsellam-releone/TRELYAN Post-Quantum Readiness Scorecard
Scan your repo for quantum-vulnerable crypto: A–F readiness grade + CycloneDX CBOM, and fail the build on broken crypto.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Directory to scan | no | . |
| fail-on | Comma-separated risk classes that fail the build (e.g. broken-classical,quantum-broken) | no | broken-classical |
| min-grade | Minimum acceptable grade (A–F); build fails below it. Empty = no grade gate. | no | "" |
| exclude | Comma-separated path globs to exclude (e.g. test-fixtures/,examples/,**/*.golden). Also readable from .pqcbomignore lines containing "/" or prefixed "path:". Excluded paths are counted in the step summary, never silently dropped. | no | "" |
Outputs
| name | description |
|---|---|
| grade | Post-Quantum Readiness grade (A–F) |
| score | Post-Quantum Readiness score (0–100) |
| sarif-file | Path to the SARIF 2.1.0 report (upload via github/codeql-action/upload-sarif to populate the Security tab) |
| cbom-file | Path to the CycloneDX CBOM (cbom.cdx.json) |