| command | Upload command: coverage, tests, scan, lint | yes | — |
| file | File path(s) or glob pattern(s) to upload (space or newline separated, e.g. "coverage/*.xml") | yes | — |
| api-key | Drape API key | yes | — |
| org | Drape organization slug (default: derived from github.repository_owner) | no | — |
| repo | Drape repository name (default: github.repository) | no | — |
| cli-version | Drape CLI version to install (default: latest) | no | latest |
| api-url | Drape API URL | no | https://app.drape.io |
| wait | Wait for server-side processing | no | true |
| wait-timeout | Max wait time, e.g. 90s, 3m, 10m, 1h30m | no | 10m |
| verbose | Enable verbose CLI output | no | false |
| group | Group label(s) for this upload | no | — |
| format | File format (coverage: cobertura/lcov/go, tests: junit/ctrf, scan: sarif/cyclonedx/grype-json/trivy-json, lint: sarif) | no | — |
| path-prefix | Path prefix mapping for coverage files | no | — |
| target-branch | Target branch for PR diff (auto-detected) | no | — |
| shard-key | Shared identifier across sibling matrix shards (auto-derived from GITHUB_RUN_ID when unset) | no | — |
| total-shards | Total coverage shards across all CI jobs in this run; must be >= 2 (coverage only) | no | — |
| drape-run-id | Drape run ID to correlate triggered CI runs; only used with coverage or tests (env fallback: DRAPE_RUN_ID) | no | — |
| scan-name | Scan name (e.g. docker image name) | no | — |
| scan-tag | Scan tag (e.g. image tag, version) | no | — |
| scan-type | Scan type: image or dependency | no | — |
| fail-on-vulnerabilities | Exit non-zero if unsuppressed vulnerabilities found | no | false |
| fail-on-severity | Minimum severity to fail on: critical, high, medium, low, any | no | medium |
| job-name | CI job name (auto-detected) | no | — |
| comment | Post a PR comment with results | no | true |
| comment-header | Sticky comment header ID (default: drape-{command}) | no | — |
| comment-title | Visible title in the PR comment (default: "Drape: {Command} — {group}") | no | — |
| github-token | GitHub token for posting PR comments | no | ${{ github.token }} |