hafizhpratama/Stryx
Run Stryx — the stack-aware TypeScript backend security scanner — on every PR and post a sticky review comment.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| directory | Path to scan. Defaults to the repository root. | no | . |
| fail-on | Minimum severity that fails the action: info, low, medium, high, critical. | no | high |
| diff | When set, scopes the scan to changes relative to this base ref (passes `--diff <value>`). | no | "" |
| github-token | GitHub token used to post the sticky PR comment. Omit to skip commenting (annotations and exit code still work). | no | "" |
| annotations | Emit per-finding ::error / ::warning annotations for inline PR feedback. | no | false |
| node-version | Node.js version used to run the npm-distributed Stryx CLI. | no | 20 |
| format | Format used for the readable log line printed in the Actions UI. The PR comment and annotations always use the JSON output internally. | no | human |
Outputs
| name | description |
|---|---|
| score | Stryx score (0–100). |
| findings-count | Total number of findings. |
| verdict | Either `pass` or `fail`, per the `fail-on` threshold. |