| config_path | Path, relative to your repository root, of the config file you would like octorules to use. | no | config.yaml |
| doit | Set "--doit" to apply changes, leave empty to plan only. | no | "" |
| force | Set "Yes" to bypass safety thresholds, leave empty to enforce them. | no | "" |
| checksum | Pass a plan checksum to octorules sync for drift protection. Only used when doit is "--doit". | no | "" |
| phases | Space separated list of rule phases to sync (e.g. "cache_rules redirect_rules"). Leave empty for all phases. | no | "" |
| zones | Space separated list of zones to sync, leave empty to sync all zones in the config file. | no | "" |
| lint | Run octorules lint before plan/sync? Set "Yes" to enable. | no | No |
| lint_severity | Minimum lint severity: "error", "warning", or "info". | no | warning |
| lint_plan | Cloudflare plan tier for lint entitlement checks (e.g. "free", "enterprise"). Defaults to "enterprise". Other providers ignore this. | no | "" |
| audit | Run octorules audit (IP overlap, IP shadow, CDN range, zone drift checks) before plan/sync? Set "Yes" to enable. | no | No |
| audit_checks | Space separated list of audit checks to run (e.g. "ip-overlap cdn-ranges"). Leave empty for all checks. | no | "" |
| audit_severity | Minimum audit severity: "error", "warning", or "info". | no | warning |
| audit_log | Path to write a JSON-lines audit log of sync results. Empty = disabled. | no | "" |
| add_pr_comment | Add plan as a comment, when triggered by a pull request? | no | No |
| pr_comment_token | Provide a token to use, if you set add_pr_comment to Yes. | no | "" |