| base-ref | Git ref to diff against (default: the PR base SHA, else HEAD^). | no | "" |
| test-command | Test command run inside the repo copy (default: pytest -q). | no | "" |
| protected | Extra space-separated globs the patch may not modify. | no | "" |
| comment | Post the report on same-repository PRs (needs pull-requests: write). Fork/Dependabot PRs keep the job summary and skip the API comment. | no | true |
| fail-on | Verdicts that fail the step: 'any-non-pass' (default) or 'rejected-only'. PR runs require any-non-pass; rejected-only is accepted only for trusted non-PR invocations. | no | any-non-pass |
| isolation | Isolation: 'subprocess' (default), 'docker', or 'gvisor' (the latter two need docker-image + a docker daemon; 'gvisor' also needs the runsc runtime). | no | "" |
| docker-image | Container image for isolation 'docker'/'gvisor' (must carry the test runner, e.g. node:22-slim). | no | "" |
| docker-network | Container network for isolation 'docker'/'gvisor' (default: 'none' — no network, the safe choice; pass a docker network name only if the suite genuinely needs it). | no | "" |
| strict-harness | Opt-in harness profile: make dependency/compiler manifests immutable and require a non-empty structured JUnit verdict. On pull_request this setting must come from the verified base .evoguard.json policy, not this workflow input. | no | "" |
| sarif | If set, write a SARIF 2.1.0 report to this workspace path (upload it with github/codeql-action/upload-sarif). | no | "" |
| allow | Baseline allowlist for adopter-defined extra protected globs only; built-in tests, config, CI, and auto-exec paths are never exemptible. | no | "" |
| allow-new-tests | Feature mode: 'true' allows brand-new test files (edits to existing tests/config/auto-exec stay rejected). | no | false |
| timeout | Per-run suite timeout in seconds. | no | "" |
| mem-limit | Address-space cap (MB) for the test subprocess; 0 disables it (needed for Node/V8 suites). | no | "" |
| verifier-pack | Repository-relative path to judge-owned pytest invariants. On a PR the Action materializes this directory from the verified base commit, never from the candidate checkout. Pair it with an EVOGUARD_PACK_V2 identity pin (input or trusted base policy). | no | "" |
| expect-verifier-pack-sha256 | Fail-closed EVOGUARD_PACK_V2 identity pin for verifier-pack (64 hex characters from pack-doctor). The accepted snapshot must match before candidate code runs. | no | "" |
| blackbox | 'true' runs the external black-box judge (needs verifier-pack). The pack must reach the candidate through $EVOGUARD_EXEC; candidate isolation is claimed only after an observed launcher invocation (and container CID). By default the repo's own suite is also required, so overall report integrity is the weaker repo-native channel. See docs/BLACKBOX.md. | no | false |
| blackbox-only | With blackbox, judge ONLY the external pack and skip the repo's own suite (for pure-CLI/service targets with no in-repo tests). Otherwise a failing repo suite blocks the merge even if the pack passes. | no | false |
| require-report-integrity | For completed PASS verdicts, fail closed unless this end-to-end report_integrity level is delivered ('same_process_candidate_writable' or 'external_process_isolated'). Static/preflight/incomplete causes remain unchanged. 'external_process_isolated' requires blackbox-only; default blackbox is composite with the weaker repo-native channel. | no | "" |
| require-candidate-isolation | For completed PASS verdicts, fail closed unless this candidate isolation is observed ('subprocess'|'docker'|'gvisor'). Preparing a runner is insufficient: blackbox requires an EVOGUARD_EXEC receipt, plus a runtime CID for docker/gvisor. Static/preflight/incomplete causes remain unchanged. | no | "" |
| trust-setup-on-host | Optional tri-state override: 'true' runs setup_command on the host (weakens effective isolation to subprocess); 'false' forces container setup; blank respects .evoguard.json. | no | "" |
| diff-coverage | 'true' measures which changed lines the suite actually executed (one extra suite run plus configured setup replay; installs the 'cov' extra). Same-process candidate code can mutate coverage state; use as a non-hostile-code quality signal, not adversarial integrity evidence. | no | false |
| min-diff-coverage | Quality gate for non-hostile code: the exact executed/total ratio below this percentage becomes FAIL; unavailable measurement becomes ERROR. Isolated startup blocks module/config shadowing, but candidate code shares and can mutate the collector process. Implies diff-coverage. | no | "" |
| baseline-evidence | 'true' adds before/after differential evidence: the suite ALSO runs on the pristine base, and the report shows repair_effect ('demonstrated' only when base FAILs and candidate PASSes under the same judge). One extra suite run; evidence only. | no | false |
| require-demonstrated-fix | Gate (implies baseline-evidence): a PASS whose repair effect is not demonstrated (base already green, or no clean baseline) becomes FAIL (fix_not_demonstrated). For agent 'fix' PRs only — ordinary feature PRs start from a green base and would fail this. | no | false |