hacks4snacks/Threat Model Forge

Analyze .tm7 threat models, upload SARIF to code scanning, and gate the build on findings.

Trust Signals

name	description	required	default
models	Glob of threat-model files to analyze, relative to the repository root.	no	*/.tm7
image	Container image that provides the tmforge CLI.	no	ghcr.io/hacks4snacks/tmforge-cli
version	Tag (or digest) of the tmforge image to run, e.g. '0.3', '0.3.1', or 'sha256:...'. Pin this to a released version for reproducible gates rather than relying on the floating default.	no	latest
max-severity	Severity at or above which findings fail the gate. One of 'error' or 'warning'. Leave empty to use the CLI default (error), so only errors gate unless you opt into warnings.	no	""
fail-on-findings	Fail the action when analysis reports gating findings (exit code 2). Set to 'false' to report without failing.	no	true
upload-sarif	Upload the SARIF results to GitHub code scanning.	no	true
category	Code-scanning category for the uploaded SARIF, so multiple analyses can coexist.	no	threat-model-forge
sarif-directory	Directory (relative to the workspace) the per-model SARIF files are written to.	no	.tmforge-sarif

name	description
result	'pass' (no gating findings), 'fail' (gating findings), or 'error' (a model could not be analyzed).
exit-code	The worst tmforge analyze category across all models: 0 (clean), 2 (findings), or 1 (error).
sarif-directory	Directory the SARIF files were written to.