caleb-todd-commits/Hedge Security Diff
Shows how a pull request changes attack surface, trust boundaries, privilege, and data flow.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | check, collect, reason, publish, init, verify, or prune | no | check |
| openai-api-key | OpenAI API key. Prefer workload identity federation for production. | no | — |
| github-token | GitHub token used to post or update the PR report. | no | — |
| root | Repository root to analyze. | no | . |
| config-path | Path to .hedge.yml. | no | .hedge.yml |
| model-triage | Optional trusted workflow override for the low-cost triage model. | no | — |
| model-analysis | Optional trusted workflow override for the deep security reasoning model. | no | — |
| base-ref | Exact base Git revision for secretless offline collection. Must be paired with head-ref. | no | — |
| head-ref | Exact head Git revision for secretless offline collection. Must be paired with base-ref. | no | — |
| offline | Disable all OpenAI requests even when a key is present. | no | false |
| collection-path | Path to the validated collection bundle for staged execution. | no | — |
| collection-manifest-path | Path to the immutable collector RunManifest. | no | — |
| reason-bundle-path | Path to the validated reason bundle for staged execution. | no | — |
| run-manifest-path | Input path to the current stage RunManifest. | no | — |
| workflow-ref | Exact GitHub workflow ref recorded by the trusted caller. | no | — |
| workflow-sha | Exact commit SHA containing the trusted workflow. | no | — |
| action-ref | Published Hedge Action reference pinned to a full commit SHA. | no | — |
| risk-id | Existing HEDGE-NNN identifier for verify or prune commands. | no | — |
| verification-evidence | Repository-relative verification JSON path for the verify command. | no | — |
| acceptance-reason | Documented risk-acceptance reason for the prune command. | no | — |
| acceptance-reason-b64 | Base64-encoded acceptance reason. Preferred in workflows to avoid multiline output injection. | no | — |
| actor | Recorded human or automation actor for lifecycle updates. | no | — |
| dry-run | Generate output without posting comments or failing the check. | no | false |
Outputs
| name | description |
|---|---|
| surface-changed | Whether an evidence-linked security architecture delta was detected. |
| open-risks | Number of open findings in this run. |
| highest-severity | Highest finding severity. |
| decision | Recorded merge decision: allow, warn, or block. |
| report-path | Path to the generated Markdown report. |
| html-report-path | Path to the standalone interactive HTML dashboard. |
| sarif-path | Path to the generated SARIF 2.1.0 report. |
| delta-path | Path to the machine-readable security architecture delta. |
| analysis-path | Path to the complete machine-readable analysis result. |
| coverage-status | Evidence coverage: complete, partial, or unsupported. |
| analysis-status | Analysis health: complete, degraded, or failed. |
| confirmed-no-delta | True only for exact revisions with complete supported coverage and no graph delta. |
| model-route | Cost-aware model route: none, deterministic, triage, analysis, triage-analysis, or fallback. |
| model-calls | Number of completed OpenAI model calls reported for this run. |
| input-tokens | Provider-reported input tokens across completed model calls. |
| output-tokens | Provider-reported output tokens, including reasoning tokens, across completed model calls. |
| total-tokens | Provider-reported total tokens across completed model calls. |
| run-manifest-path | Path to the integrity-bound RunManifest v0.1 artifact. |
| collection-path | Path to the secretless exact-revision collection bundle. |
| collection-manifest-path | Path to the immutable collector RunManifest. |
| reason-bundle-path | Path to the schema-validated reasoning bundle. |