eresussecurity/Eresus Sentinel Security Scan
Run Eresus Sentinel security scans (SAST, artifact, firewall, AIBOM, red team) in CI/CD pipelines.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 15, 2026
- License
- None
Pinned Snippet
uses: eresussecurity/eresus-sentinel@b4b19446da8d4b1aba48640cf4d856efee481c89 # v0.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| scan-path | Path to scan (default: repository root) | no | . |
| fail-on-severity | Minimum severity that causes a non-zero exit code (critical|high|medium|low) | no | high |
| format | Output format: sarif|json|html|junit|csv|markdown (default: sarif) | no | sarif |
| output-file | Write report to this file (default: sentinel-results.<format>) | no | "" |
| extra-args | Additional arguments passed verbatim to sentinel scan | no | "" |
| enable-aibom | Also run sentinel aibom and upload AIBOM artifact | no | false |
| upload-sarif | Upload SARIF to GitHub Code Scanning (requires write permissions) | no | true |
| sentinel-version | Eresus Sentinel version to install (default: latest) | no | latest |
| eval-config | Path to eval YAML config file. When set, run sentinel evaluate after the scan. | no | "" |
| fail-on-threshold | Minimum eval pass rate (0.0–1.0) that causes a non-zero exit code. Only used when eval-config is set. | no | 0.0 |
| pr-comment | Post a summary comment on the PR with finding counts and eval results (requires pull-requests: write) | no | true |
| max-concurrency | Maximum number of parallel eval workers (default: 4) | no | 4 |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF file |
| finding-count | Total number of findings |
| exit-code | Sentinel exit code (0=clean, 1=findings above threshold, 2=error) |