busbar-actions/Busbar Permissions Audit

Cedar-based security analysis of Salesforce metadata — permissions, sharing, FLS, flows

Trust Signals

name	description	required	default
metadata-path	Directory or MDAPI zip of Salesforce metadata to audit (e.g. force-app/main/default).	yes	—
package-xml	Path to a package.xml to scope the audit. Optional.	no	""
policies	Path to a Cedar policy bundle (dir of .cedar files) for custom org rules. Empty = built-in baseline policies.	no	""
severity-threshold	Minimum severity to include. One of: info, low, medium, high, critical.	no	medium
fail-on-severity	Exit non-zero if any finding meets or exceeds this severity. Set to "never" to disable.	no	high
report-path	Where to write the findings JSON report.	no	security-findings.json
sarif	Also emit a SARIF report for GitHub Code Scanning.	no	true
sarif-path	Where to write the SARIF report (only used when sarif=true).	no	security-findings.sarif
upload-sarif	Upload the SARIF report to GitHub Code Scanning (requires security-events: write).	no	true
comment-pr	Post a findings summary as a PR comment on pull_request events.	no	true
upload-artifact	Upload the JSON report (and SARIF if generated) as a workflow artifact.	no	true
artifact-name	Artifact name when upload-artifact=true.	no	security-findings
version	Release tag of the sf-permissions-audit binary. Falls back to env.BUSBAR_ACTION_VERSION, then "latest".	no	""
binary-repo	GitHub repo hosting prebuilt binary releases. Falls back to env.BUSBAR_ACTION_REPO, then busbar-actions/actions-dist.	no	""

name	description
findings-count	Total findings at or above the severity threshold.
critical-count	Number of Critical-severity findings.
high-count	Number of High-severity findings.
medium-count	Number of Medium-severity findings.
threshold-breached	"true" if any finding met or exceeded fail-on-severity.
report-path	Path to the JSON findings report.
sarif-path	Path to the SARIF report (empty if sarif=false).