edamametechnologies/Setup EDAMAME Posture
Download and control EDAMAME Posture
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 16, 2026
- License
- Apache 2.0
Pinned Snippet
uses: edamametechnologies/edamame_posture_action@07b5f75ac2d977377e157038dd3aca4f276cf960 # v1.1.5tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| edamame_user | EDAMAME user (required to start the process in the background) | no | — |
| edamame_domain | EDAMAME domain (required to start the process in the background) | no | — |
| edamame_pin | EDAMAME PIN (required to start the process in the background) | no | — |
| edamame_id | EDAMAME identifier suffix (required to start the process in the background) | no | — |
| edamame_policy | EDAMAME policy name that the device must comply with (the action will fail if the device does not comply) | no | — |
| edamame_minimum_score | Minimum score that the device must achieve (the action will fail if the device does not achieve the minimum score) | no | — |
| edamame_mandatory_threats | Comma separated list of mandatory threats that the device must not exhibit (the action will fail if the device does not detect the threats) | no | — |
| edamame_mandatory_prefixes | Comma separated list of mandatory tag prefixes covering threats that the device must not exhibit (the action will fail if the device does not have the prefixes) | no | — |
| auto_remediate | Automatically remediate posture issues | no | false |
| skip_remediations | Remediations to skip when performing auto-remediations (comma separated) | no | remote login enabled,remote desktop enabled,local firewall disabled |
| network_scan | Scan network for critical devices (only applicable if the background process is started) | no | false |
| packet_capture | Capture network traffic (auto = follow network_scan) | no | auto |
| check_whitelist | Report and enforce whitelist exceptions when capturing network traffic (requires a whitelist name) | no | false |
| check_blacklist | Report and enforce blacklist matches during network capture | no | true |
| check_anomalous | Deprecated for live enforcement; vulnerability findings are now used for live cancellation | no | true |
| cancel_on_violation | Attempt to cancel the current CI pipeline when violations are detected | no | false |
| cancel_pipeline_script | Path to custom cancellation script (default: /tmp/cancel_pipeline.sh). Script receives violation reason as first argument. | no | "" |
| disconnected_mode | Start EDAMAME Posture in disconnected mode without requiring domain authentication | no | false |
| dump_sessions_log | Dump sessions log (requires background process with packet capture enabled) | no | false |
| checkout | Checkout the repo through the git CLI (retry if access is not granted) | no | false |
| checkout_submodules | Checkout submodules | no | false |
| wait_for_https | Wait for https access to the repo be granted | no | false |
| wait | Wait for a while for access to be granted | no | false |
| wait_for_api | Wait for API access to be granted | no | false |
| token | GitHub token to checkout the repo | no | ${{ github.token }} |
| whitelist | Whitelist to use for the network scan (only applicable if the background process is started) | no | "" |
| exit_on_whitelist_exceptions | Exit with error when whitelist exceptions are detected (directly passed to get-sessions) | no | true |
| exit_on_blacklisted_sessions | Exit with error when blacklisted sessions are detected (directly passed to get-sessions) | no | false |
| exit_on_anomalous_sessions | Exit with error when anomalous sessions are detected (directly passed to get-sessions) | no | false |
| vulnerability_detection | [Legacy alias of attack_pattern_detection] Start the runtime attack pattern detector during setup. Prefer attack_pattern_detection in new workflows; vulnerability_detection will be deprecated in a future major version. | no | false |
| vulnerability_detection_interval | [Legacy alias of attack_pattern_detection_interval] Runtime attack pattern detector tick interval in seconds. Prefer attack_pattern_detection_interval. | no | 60 |
| dump_vulnerability_findings | [Legacy alias of dump_attack_pattern_findings] Dump runtime attack pattern detector status/findings during a later action invocation. Prefer dump_attack_pattern_findings. | no | false |
| exit_on_vulnerability_findings | [Legacy alias of exit_on_attack_pattern_findings] Exit with error when active runtime attack pattern findings are detected. Prefer exit_on_attack_pattern_findings. | no | true |
| attack_pattern_detection | Start the runtime attack pattern detector during setup. Preferred name; supersedes vulnerability_detection. | no | "" |
| attack_pattern_detection_interval | Runtime attack pattern detector tick interval in seconds. Preferred name; supersedes vulnerability_detection_interval. | no | "" |
| dump_attack_pattern_findings | Dump runtime attack pattern detector status/findings during a later action invocation. Preferred name; supersedes dump_vulnerability_findings. | no | "" |
| exit_on_attack_pattern_findings | Exit with error when active runtime attack pattern findings are detected. Preferred name; supersedes exit_on_vulnerability_findings. | no | "" |
| dump_attack_pattern_trace | Dump the latest VulnerabilityDebugTrace JSON during a later action invocation, and upload it as the `edamame-fp-capture` GitHub artifact. The artifact is the canonical CI input for `tools/ingest_ci_fp_corpus.sh`, which shapes it into Shape A entries under `edamame_core/tests/fp_corpus/<FP-ID>/` (FP replay corpus -- see `edamame_core/FPREPLAY.md`). Requires a posture binary that exposes `vulnerability-debug-trace --latest` (edamame_posture >= 1.3.18+); older binaries will print a clap usage error and the step will fail soft -- inspect the runner log to confirm. | no | false |
| file_monitoring | Enable file integrity monitoring during the workflow | no | false |
| file_monitoring_paths | Comma-separated paths to monitor (default: workspace + temp dirs) | no | "" |
| check_file_tampering | Report file integrity monitoring events in the dump step | no | false |
| exit_on_file_tampering | Exit with error when suspicious file events are detected | no | false |
| report_email | Report email address | no | "" |
| create_custom_whitelists | Create custom whitelists from captured network sessions and save it to the specified path | no | false |
| include_process_in_whitelist | Include process names in whitelist entries for stricter matching. When enabled, connections from different processes to the same endpoint are treated separately. | no | false |
| custom_whitelists_path | Path to save or load custom whitelists JSON (used with create_custom_whitelists or to provide a whitelist file to apply) | no | "" |
| set_custom_whitelists | Apply custom whitelists from a file specified in custom_whitelists_path | no | false |
| augment_custom_whitelists | Augment the existing custom whitelists using current network sessions and merge the result back into the file specified by custom_whitelists_path. Requires network_scan=true. | no | false |
| auto_whitelist | Enable auto-whitelist mode: first run is listen-only, subsequent runs refine whitelist until stable. Requires packet_capture=true to capture traffic for comparison and wait_for_api=true to wait for the API to be ready. Usage pattern (two-invocation): 1. First invocation: Setup with auto_whitelist=true (starts daemon, applies whitelist) 2. Do work: Generate traffic (daemon captures in background) 3. Second invocation: dump_sessions_log=true (augments whitelist, uploads artifact) The action automatically handles both phases when called twice in the same job. | no | false |
| auto_whitelist_artifact_name | Name for the GitHub artifact that stores auto-whitelist state between workflow runs in this repository (default: edamame-auto-whitelist). Key artifacts by the job's runs-on runner pool, not runner.os alone, so self-hosted and GitHub-hosted jobs do not share one learned whitelist. Matrix jobs: edamame-auto-whitelist-<matrix.runs-on>. Fixed runs-on: edamame-auto-whitelist-<same-label-as-runs-on>. Use runner.os in the name only when you intentionally want one whitelist shared across every pool on that OS. | no | edamame-auto-whitelist |
| auto_whitelist_stability_threshold | Percentage threshold for whitelist stability (default: 0% - no new endpoints) | no | 0 |
| auto_whitelist_stability_consecutive_runs | Number of consecutive runs with no changes required for stability (default: 3) | no | 3 |
| auto_whitelist_max_iterations | Maximum number of auto-whitelist iterations before declaring stable (default: 25) | no | 25 |
| auto_whitelist_state_artifact_name | Name for the artifact storing auto-whitelist state (default: auto-whitelist-state) | no | auto-whitelist-state |
| promote_exceptions | Promote whitelist exceptions immediately without waiting for stability. When true, any non-conforming sessions are added to the whitelist regardless of stability state. This is useful during releases to quickly update whitelists without multiple iterations. | no | false |
| include_local_traffic | Include local traffic in network capture and session logs | no | false |
| agentic_mode | AI assistant mode for automated security todo processing: auto (execute), analyze (recommendations only), or disabled | no | disabled |
| agentic_provider | LLM provider for AI assistant: edamame (recommended), claude, openai (all use EDAMAME_LLM_API_KEY env), ollama (uses EDAMAME_LLM_BASE_URL env), or none | no | none |
| agentic_interval | Interval in seconds for automated AI assistant todo processing | no | 3600 |
| stop | Stop the EDAMAME Posture process | no | false |
| display_logs | Dump the EDAMAME daemon's rolling log files (/var/log/edamame/edamame_*_<pid>.YYYY-MM-DD on Unix, beside the binary on Windows) to the job log AND copy them to $RUNNER_TEMP/edamame-daemon-logs/. Path is exported as EDAMAME_DAEMON_LOGS_PATH for downstream actions/upload-artifact steps. | no | false |
| debug | Debug mode | no | false |
| get_device_info | Display device info including eBPF support status (Linux only) | no | false |
| verify_ebpf | Verify eBPF is properly embedded in the binary. Fails if eBPF was not compiled in (build failure). Runtime restrictions (kernel settings, containers) are acceptable and won't fail. Implies get_device_info=true. (Linux only) | no | false |
Outputs
| name | description |
|---|---|
| ebpf_status | eBPF support status: enabled, disabled_build, disabled_runtime, not_supported, or unknown |
| ebpf_message | Human-readable eBPF status message |