busbar-actions/Busbar PII Scan

Scan extracted Salesforce datasets (CSVs) for PII and secrets, emit findings and SARIF

Trust Signals

name	description	required	default
input-path	File or directory to scan. Directories are walked recursively for CSVs.	yes	—
severity-threshold	Minimum severity to include in the report. One of: info, low, medium, high, critical.	no	medium
fail-on-severity	Exit non-zero if any finding meets or exceeds this severity. Same scale as severity-threshold. Set to "never" to disable.	no	critical
config-file	Path to a ValidationConfig JSON (custom patterns, skip lists, entropy thresholds, etc.). Optional.	no	""
report-path	Where to write the findings JSON report.	no	pii-findings.json
sarif	Also emit a SARIF report for GitHub Code Scanning integration.	no	true
sarif-path	Where to write the SARIF report (only used when sarif=true).	no	pii-findings.sarif
upload-sarif	Upload the SARIF report to GitHub Code Scanning (requires security-events: write).	no	true
comment-pr	Post a findings summary as a PR comment when running on a pull_request event.	no	true
upload-artifact	Upload the JSON report (and SARIF if generated) as a workflow artifact.	no	true
artifact-name	Name to give the uploaded artifact.	no	pii-findings
version	Release tag of the sf-pii-scan binary. Falls back to env.BUSBAR_ACTION_VERSION, then "latest".	no	""
binary-repo	GitHub repo hosting prebuilt binary releases. Falls back to env.BUSBAR_ACTION_REPO, then busbar-actions/actions-dist.	no	""

name	description
findings-count	Total number of findings at or above the severity threshold.
critical-count	Number of Critical-severity findings.
high-count	Number of High-severity findings.
medium-count	Number of Medium-severity findings.
threshold-breached	"true" if any finding met or exceeded fail-on-severity.
report-path	Path to the JSON findings report.
sarif-path	Path to the SARIF report (empty if sarif=false).