charlescnorton/Touchstone scan
Symbolic trap-freedom scan of a Python repository; uploads findings to GitHub code scanning as SARIF.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Path, owner/repo slug, or URL to scan. | — | . |
| execute | Replay each finding in the sandbox to confirm genuine bugs (true/false). | — | false |
| baseline | Path to a baseline file; only a finding not already recorded there fails the run. | — | "" |
| exclude | Comma-separated fnmatch globs to drop from triage (also read from [tool.touchstone]). | — | "" |
| fail-on | Which findings fail the run: bug | suspected | any | none (default: the built-in policy). | — | "" |
| args | Extra arguments passed through to `touchstone scan`. | — | "" |
| version | Version spec for the pip install, e.g. '==1.14.0' (default: latest). | — | "" |
| upload-sarif | Upload the SARIF to GitHub code scanning (true/false). Needs security-events: write. | — | true |
Outputs
| name | description |
|---|---|
| sarif | Path to the generated SARIF file. |
| exit-code | The scan's exit code (0 pass, 1 a finding failed the policy). |