bumahkib7/Qryon

Ultra-fast code intelligence and security analyzer with SARIF output, GitHub Code Scanning integration, and PR comments

Trust Signals

workflow.ymlSHA-pinned

uses: bumahkib7/qryon@ba29ea5a4900c21c8e737b771696a6025461b517 # v0.20.1

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
path	Path to scan (relative to repository root)	no	.
format	Output format: text, json, sarif, compact, markdown, github	no	sarif
severity	Minimum severity to report: info, warning, error, critical	no	warning
cross-file	Enable cross-file analysis (import resolution, call graph, taint tracking)	no	false
diff-only	Only scan files changed in the PR/commit (auto-enabled for PRs if not set)	no	""
diff-base	Base git ref for diff comparison (default: origin/main for PRs)	no	origin/main
enable-rules	Comma-separated list of rule IDs to enable	no	""
disable-rules	Comma-separated list of rule IDs to disable	no	""
fail-on-findings	Fail the action if findings are detected	no	true
upload-sarif	Upload SARIF results to GitHub Code Scanning	no	true
comment-on-pr	Post/update a PR comment with findings summary	no	true
version	Qryon version to use (e.g., v0.12.0, latest)	no	latest
profile	Analysis profile: fast, balanced, strict	no	balanced
providers	Comma-separated analysis providers: qryon,oxc,osv	no	qryon
languages	Comma-separated list of languages to scan (e.g., rust,python,javascript)	no	""
extra-args	Additional arguments to pass to qryon scan	no	""
token	GitHub token for API access (defaults to github.token)	no	${{ github.token }}

name	description
findings-count	Total number of findings detected
sarif-file	Path to the generated SARIF file
exit-code	Exit code from Qryon scan
summary	JSON summary of findings by severity