gidotencate/padlock-action
Detect padding waste, false sharing, and cache locality problems in C, C++, Rust, and Go structs.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 19, 2026
- License
- None
Pinned Snippet
uses: gidotencate/padlock@6204d6d9cc98486a0858848717fe79e4b375f12b # v0.10.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to a binary (.o, ELF), source file (.c, .cpp, .rs, .go), or directory to analyse. Multiple paths can be passed as a newline-separated string. | yes | — |
| fail-on-severity | Minimum severity that causes the step to exit non-zero (blocking the merge). Valid values: `high` (default), `medium`, `low`, `none`. | — | high |
| output-format | `human` (default) — coloured summary printed to the log. `json` — machine-readable JSON written to `padlock-results.json`. `sarif` — SARIF 2.1.0 written to `padlock-results.sarif` and optionally uploaded to GitHub Code Scanning. `markdown` — GFM report appended to the GitHub Actions step summary (`$GITHUB_STEP_SUMMARY`) so findings appear on the workflow summary page without leaving the Actions UI. | — | human |
| upload-sarif | When `true` and `output-format` is `sarif`, automatically upload the SARIF report to GitHub Code Scanning. Requires `security-events: write` permission in the calling workflow. | — | true |
| target | Target architecture for source analysis. Accepts a Rust target triple (e.g. `aarch64-apple-darwin`) or a short name (`aarch64_apple`, `wasm32`, `riscv64`). Defaults to the runner's host architecture. Use this when analysing code that will be compiled for a different platform — most commonly Apple Silicon cache-line layout from a Linux CI host. | — | "" |
| hide-repr-rust | When `true`, exclude `repr(Rust)` structs from all output. Useful when you want to focus CI gating on types with a fixed binary layout (C, `repr(C)`, Go, Zig) where findings are fully accurate. | — | false |
| padlock-version | Version of padlock to install (e.g. `0.9.3`). Defaults to `latest`. Pin to a specific version for reproducible CI. | — | latest |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings across all severity levels. |
| high-count | Number of High-severity findings. |
| medium-count | Number of Medium-severity findings. |
| low-count | Number of Low-severity findings. |