| version | The version of SCFW to install. Use "latest" for the most recent release (default), or pin to a specific version (e.g., "0.7.0").
| no | latest |
| package-managers | Comma-separated list of the package managers whose commands should be inspected. Supported values: pip, npm, poetry. Defaults to all three.
| no | npm,pip,poetry |
| error-on-block | When "true" (default), blocked package installations cause the step to exit with a non-zero code, failing the workflow. Set to "false" to allow the workflow to continue even when installations are blocked.
| no | true |
| dd-api-key | Datadog API key for forwarding firewall events to the Datadog HTTP API. Treat this value as a secret.
| no | "" |
| dd-app-key | Datadog application key. Required when using dd-codesec-logger. Treat this value as a secret.
| no | "" |
| dd-api-logger | When "true", enables SCFW's Datadog HTTP API logger (sets SCFW_DD_API_LOGGER_ENABLED). Requires dd-api-key to be set.
| no | false |
| dd-codesec-logger | When "true", enables SCFW's Datadog Code Security logger (sets SCFW_DD_CODESEC_LOGGER_ENABLED). Requires both dd-api-key and dd-app-key to be set.
| no | false |
| dd-site | Datadog site parameter specifying the data center where the user's Datadog org is hosted (e.g., datadoghq.eu, us3.datadoghq.com). Used by both dd-api-logger and dd-codesec-logger.
| no | datadoghq.com |
| dd-log-level | Controls which SCFW logs are forwarded to Datadog. "ALLOW" causes allowed and blocked package manager commands to be logged; "BLOCK" causes only blocked commands to be logged.
| no | ALLOW |
| scfw-home | Directory for SCFW's local cache (verifier data). Defaults to a temporary directory when not specified. Set this to a cached directory to speed up verifier data fetches across runs.
| no | "" |
| on-warning | Action to take when SCFW finds only warning-level issues: "ALLOW" to proceed with installation, "BLOCK" to reject it. In non-interactive environments like CI, SCFW defaults to "BLOCK" when not specified.
| no | "" |
| package-minimum-age | Minimum age in hours that a package must have before SCFW allows its installation. Helps guard against dependency confusion and typosquatting attacks using newly published packages. Defaults to 24 when not specified.
| no | "" |
| dd-env | Datadog environment tag attached to all forwarded firewall events (sets DD_ENV). Defaults to "ci" when not specified.
| no | ci |
| dd-log-attributes | A JSON object of custom attributes to attach to all forwarded Datadog log events (sets SCFW_DD_LOG_ATTRIBUTES). Example: '{"team":"security","repo":"my-repo"}'.
| no | "" |