guard0-ai/g0 AI Agent Security Scan
Scan AI agent code for security risks, gate on thresholds, post a PR comment, upload SARIF, and write a job summary.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan | — | . |
| min-score | Minimum overall security score (0-100). Ignored when `baseline` is set (regression mode). | — | 70 |
| min-grade | Minimum grade (A, B, C, D). Ignored when `baseline` is set (regression mode). | no | "" |
| fail-on | Fail on severity level: "critical" (fail on any critical finding) or "high" (fail on any high or critical finding). | — | high |
| ruleset | Rule set to run: recommended, extended, or all | no | "" |
| config | Path to a g0 config file (default: auto-detect .g0.yaml) | no | "" |
| baseline | Path to a committed baseline file (from `g0 gate --write-baseline`). When set, absolute score/grade gates are skipped and only findings new vs. the baseline are evaluated (regression mode). | no | "" |
| compare-to-base | On pull_request events, scan the PR base branch in a temporary git worktree and report the score delta + new findings vs. base. Requires the checkout step to use `fetch-depth: 0`. | — | true |
| sarif | Write a SARIF report of findings | — | true |
| upload-sarif | Upload the SARIF report to GitHub Code Scanning (requires the `security-events: write` permission; unavailable on forked-repo PRs) | — | true |
| pr-comment | Post (and keep updated) a sticky PR comment with the scan report | — | true |
| comment-mode | "update" finds and edits the existing g0 comment on the PR, or creates one if none exists. Any other value always creates a new comment. | — | update |
| signup-cta | Include a one-line guard0.ai signup link at the bottom of the PR comment / job summary | — | true |
| github-token | Token used for the PR comment and SARIF upload | — | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| score | Overall security score (0-100) |
| grade | Letter grade (A-F) |
| passed | "true" or "false" — whether the gate passed |
| critical | Count of critical findings |
| high | Count of high findings |
| medium | Count of medium findings |
| low | Count of low findings |
| new-findings | Count of findings new vs. base/baseline (empty if neither `compare-to-base` nor `baseline` applied) |
| sarif-file | Path to the generated SARIF file (empty if `sarif: false`) |