getprovenant/Provenant Scan

Run the Provenant license, copyright, and SBOM scanner in CI, with license-policy gating and SARIF output.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
paths	Space-separated files or directories to scan, relative to the repository root. Defaults to the whole checkout.	no	.
output-format	Output format flag to use. One of: json-pp, json, json-lines, yaml, cyclonedx, cyclonedx-xml, spdx-tv, spdx-rdf. Maps to the matching `provenant scan --<format>` flag.	no	json-pp
output-file	Where to write the scan report. Use "-" (the default) to stream to the workflow log on stdout, or a path such as "provenant-results.json" to write a file in the workspace.	no	-
args	Extra raw arguments appended verbatim to `provenant scan`. This is where you opt into detections and tuning, e.g. "--license --package --copyright". Detections are opt-in, so with the default empty value the scan collects file inventory only.	no	--license --package
paths-file	Optional path to a file listing the exact files/directories to scan, one per line, relative to the single scan root in `paths` (which must stay a single root, the default "."). Ideal for pull-request CI: feed it the output of `git diff --name-only` to scan only changed files. Leave empty to scan `paths` directly.	no	""
license-policy	Optional path to a YAML license-policy file (see the Provenant CLI guide for the format). Enables policy evaluation; required by `fail-on` and by SARIF output.	no	""
fail-on	Fail the job (exit code 3) when a scanned file matches a policy whose compliance_alert is at or above this level: "error" or "warning". Requires `license-policy`. Leave empty to report without gating.	no	""
sarif-file	Optional path to also write SARIF 2.1.0 of policy violations, for uploading with github/codeql-action/upload-sarif so findings appear as pull-request and code-scanning alerts. Meaningful only with `license-policy`.	no	""

Outputs

no outputs