g2cv/CASM Auto-Diff
Run CASM unified scans, diff against a baseline SARIF, and publish evidence-first GitHub comments.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 19, 2026
- License
- AGPL 3.0
Pinned Snippet
uses: g2cv/casm@7fcae3d4e27ba9fe95b7a75d6351d3f885aa9dd8 # v0.3.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| scope-path | Path to the CASM scope file | yes | — |
| targets-file | Optional JSON targets file | no | "" |
| run-out-dir | Directory where CASM run artifacts are written | no | runs/current |
| baseline-path | Baseline SARIF path used for diffing | no | .casm/baseline/results.sarif |
| casm-version | Package spec passed to pip install (for example g2cv-casm or g2cv-casm==1.2.3) | no | g2cv-casm |
| python-version | Python runtime version | no | 3.11 |
| dry-run | Whether to run CASM in dry-run mode | no | false |
| report-lang | CASM report language (en or fr) | no | en |
| formats | CASM output formats (comma-separated or all) | no | markdown,sarif |
| enable-dns-enum | Enable DNS enumeration in unified scans | no | false |
| dns-wordlist | Optional DNS wordlist path | no | "" |
| tool-filter | Tool suffix filter for SARIF diff | no | http_verify |
| post-mode | Publish mode (none, auto, issue, pr) | no | auto |
| pr-number | Explicit PR number for comment posting | no | "" |
| issue-number | Explicit issue number for comment posting | no | "" |
| issue-title | Baseline issue title when auto-creating issue comments | no | CASM Security Baseline |
| issue-labels | Comma-separated labels used when creating baseline issue | no | "" |
| max-findings | Max added/removed findings shown in report sections | no | 20 |
| post-on-no-change | Publish report even when baseline diff has no added/removed findings | no | false |
| github-token | GitHub token override for API publishing | no | "" |
| fail-on-publish-error | Fail the action if the reporter cannot publish comments | no | false |
Outputs
| name | description |
|---|---|
| has-baseline | Whether a baseline SARIF was present before the run |
| has-changes | Whether diff found added or removed findings |
| added-count | Added findings count |
| removed-count | Removed findings count |
| unchanged-count | Unchanged findings count |
| published | Whether a GitHub comment was published |
| target-kind | Publish target kind (pr, issue, none) |
| target-number | Publish target number, when available |
| post-skipped-reason | Reason publish was skipped, when applicable |
| sarif-path | SARIF output path |
| evidence-path | Evidence JSONL output path |
| report-path | Markdown report output path |
| summary-path | Auto-diff markdown summary path |
| baseline-path | Updated baseline SARIF path |