danilotrix86/ArchiteX for Terraform

Architecture firewall for Terraform PRs. Posts a deterministic risk report as a sticky PR comment and uploads an audit bundle.

Trust Signals

workflow.ymlSHA-pinned

uses: danilotrix86/architex@870f3540ef20d87973b5f2a80562d4070f00940a # v1.4.2

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
terraform-dir	Subdirectory (relative to repo root) that contains the Terraform .tf files to analyze. Use "." for the repo root.	no	.
base-ref	Git ref for the base side of the diff. Defaults to the PR base SHA when triggered by pull_request.	no	${{ github.event.pull_request.base.sha }}
head-ref	Git ref for the head side of the diff. Defaults to the PR head SHA when triggered by pull_request.	no	${{ github.event.pull_request.head.sha }}
mode	"advisory" (default) never fails the check. "blocking" fails the check when risk.Status == "fail".	no	advisory
comment	When "true", post the Markdown report as a sticky PR comment. Set to "false" to suppress (artifact upload still runs).	no	true
upload-artifact	When "true", upload the audit bundle (diagram, summary, score, egress, manifest) as a workflow artifact.	no	true
salt	Salt used by the sanitizer when hashing IDs in the egress payload. Empty = stable IDs across runs (good for trend diffing).	no	""
github-token	Token used to post the PR comment. Defaults to the workflow GITHUB_TOKEN. Requires pull-requests:write.	no	${{ github.token }}
go-version-file	Path passed to actions/setup-go go-version-file input. Defaults to the action's own go.mod.	no	""

name	description
bundle-path	Filesystem path of the produced audit bundle directory.
status	risk.Status from the report: pass \| warn \| fail.
score	risk.Score from the report (0.0 - 10.0).