garvitbanga/DevSecOps PR Gate
Blocks risky PRs by running Trivy, Checkov, and OPA/Conftest with a sticky PR summary
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| paths-app | Directory to scan with Trivy (filesystem) | no | app/ |
| paths-iac | Directory to scan with Checkov/OPA | no | infra/ |
| fail-on | Fail job if any finding >= this level (critical|high|off) | no | high |
| opa-policy-path | Path to Rego policies for Conftest | no | policies/conftest |
| trivy-version | Trivy version to install (default: latest stable) | no | v0.48.0 |
| checkov-version | Checkov version to install (default: latest stable) | no | 2.3.0 |
| conftest-version | Conftest version to install (default: latest stable) | no | v0.45.0 |
| trivy-args | Additional arguments to pass to Trivy | no | — |
| checkov-args | Additional arguments to pass to Checkov | no | — |
| conftest-args | Additional arguments to pass to Conftest | no | — |
| comment-title | Title for the sticky PR comment | no | DevSecOps PR Gate |
Outputs
| name | description |
|---|---|
| comment-url | URL of the created/updated PR comment |
| trivy-high | Number of HIGH severity findings from Trivy |
| trivy-critical | Number of CRITICAL severity findings from Trivy |
| checkov-high | Number of HIGH severity findings from Checkov |
| checkov-critical | Number of CRITICAL severity findings from Checkov |
| opa-deny-count | Number of policy violations from OPA/Conftest |
| has-blockers | Whether there are blocking findings (true|false) |