giacomozanatta/FastAPI Routing Check
Statically detect silent routing defects in FastAPI applications (duplicate-include, route shadowing, conditional registration) via lisa-network abstract interpretation.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| main-file | Path (relative to the repo root) of the FastAPI entrypoint, e.g. app/main.py. | yes | — |
| project-dir | Project root passed to the analyzer (used as import-resolution base). Defaults to the workspace root. | no | . |
| output-dir | Directory where final-network.{txt,html,pdf} and report.json are written. | no | lisa-network-out |
| fail-on-finding | Fail the job when the routing checker reports one or more findings. | no | true |
| severity-threshold | Only fail on findings at or above this severity (high | medium). With "high", medium-severity findings are surfaced as annotations but do not fail the job. | no | high |
| families | Comma-separated list of finding families to surface. Findings in any other family are dropped before counts, annotations, comment, and the gate. Default reports all five; set e.g. "duplicate-include,wrong-handler" to suppress the rest. Valid values: duplicate-include, wrong-handler, dead-handler, duplicate-registration, conditional-registration. Use "all" or leave empty to include every family. | no | all |
| jvm-heap | Max JVM heap for the analyzer (passed as -Xmx). Default 4g matches the per-run budget used in the empirical study. | no | 4g |
| annotations | Emit ::warning file=,line=:: workflow commands so findings appear as inline annotations on the Files Changed tab of the PR. Capped by GitHub at 10 per severity per run. | no | true |
| comment-on-pr | Post (or update) a sticky comment on the PR with a markdown table linking each finding to file:line on the analysed commit. Requires GITHUB_TOKEN with pull-requests:write. | no | true |
Outputs
| name | description |
|---|---|
| endpoints-count | Number of HTTP endpoints recovered by the analyzer. |
| findings-count | Total number of routing-checker findings emitted. |
| high-severity-count | Number of high-severity routing-checker findings (wrong-handler, duplicate-include). |
| report-path | Path to the report.json file containing all findings. |