harekrishnarai/Flowlyt Security Analyzer
Enterprise-grade security scanner for GitHub Actions workflows with policy enforcement
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 9, 2026
- License
- Apache 2.0
Pinned Snippet
uses: harekrishnarai/flowlyt@5ef5197856916c21da1284035e0413ac70cd273c # v2.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| repository | Repository to scan. Defaults to the current repository. | no | . |
| token | GitHub token used to access repositories and create comments | no | "" |
| config-file | Path to Flowlyt configuration file | no | .flowlyt.yml |
| output-format | Output format (cli, json, markdown, sarif) | no | sarif |
| output-file | Output file path for findings | no | flowlyt-results.sarif |
| min-severity | Minimum severity level to report (INFO, LOW, MEDIUM, HIGH, CRITICAL) | no | LOW |
| fail-on-severity | Fail the action if findings with this severity or higher are found (CRITICAL, HIGH, MEDIUM, LOW, INFO). Leave empty to never fail. | no | CRITICAL |
| max-critical | Maximum number of critical findings allowed before failing (0 = no limit) | no | 0 |
| max-high | Maximum number of high severity findings allowed before failing (0 = no limit) | no | 0 |
| enable-policy-enforcement | Enable enterprise policy enforcement | no | false |
| enable-vuln-intel | Enable vulnerability intelligence from OSV.dev | no | false |
| enable-ast-analysis | Enable Advanced Static Analysis with data flow tracking | no | false |
| policy-config | Path to enterprise policy configuration file | no | "" |
| compliance-frameworks | Comma-separated list of compliance frameworks to evaluate | no | "" |
| comment-on-pr | Whether to comment results on pull requests | no | true |
| upload-sarif | Upload SARIF results to GitHub Security tab | no | true |
| sarif-category | Category for SARIF upload (helps organize multiple scans) | no | flowlyt |
| create-issue | Create GitHub issue for critical violations | no | false |
| issue-labels | Comma-separated labels for created issues | no | security,flowlyt |
| continue-on-error | Continue workflow even if critical issues are found | no | false |
| verbose | Enable verbose output for debugging | no | false |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings |
| critical-count | Number of critical findings |
| high-count | Number of high severity findings |
| medium-count | Number of medium severity findings |
| low-count | Number of low severity findings |
| policy-violations | Number of policy violations |
| blocking-violations | Number of blocking policy violations |
| compliance-status | Overall compliance status (true/false) |
| results-file | Path to the results file |
| sarif-file | Path to the SARIF results file |
| exit-code | Exit code of the scan (0=success, 1=findings above threshold, 2=error) |
| summary | Summary of findings in markdown format |