hashgraph-online/HOL AI Plugin Scanner
Scan AI plugin repositories for security, publishability, and best-practice quality signals.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 11, 2026
- License
- None
Pinned Snippet
uses: hashgraph-online/hol-codex-plugin-scanner-action@b8c9b978a15a9d0320b623eedb905e19020eb1e7 # v1.2.434tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | Execution mode: scan, lint, verify, or submit | no | scan |
| plugin_dir | Path to a single plugin directory or a repo marketplace root (default: repository root) | no | . |
| format | Output format: text, json, markdown, or sarif | no | text |
| output | Write report to this file path | no | "" |
| profile | Policy profile to apply: default, public-marketplace, or strict-security | no | default |
| config | Optional path to a scanner config file such as .plugin-scanner.toml | no | "" |
| baseline | Optional path to a baseline suppression file | no | "" |
| online | Enable live network probing for verify mode | no | false |
| upload_sarif | Upload the generated SARIF report to GitHub code scanning. Requires security-events: write in the calling workflow. | no | false |
| sarif_category | SARIF category used when upload_sarif is enabled | no | ai-plugin-scanner |
| write_step_summary | Write a concise markdown summary to the GitHub Actions job summary | no | true |
| registry_payload_output | Write a machine-readable plugin ecosystem payload JSON file for registry or awesome-list automation | no | "" |
| min_score | Fail the job if the score is below this threshold (0-100) | no | 0 |
| fail_on_severity | Fail if any finding meets or exceeds this severity (none, critical, high, medium, low, info) | no | none |
| cisco_skill_scan | Cisco skill-scanner mode: auto, on, or off | no | auto |
| cisco_policy | Cisco skill-scanner policy preset: permissive, balanced, or strict | no | balanced |
| install_source | Package install source: pypi for the reviewed release path, or local for source-repo dogfooding | no | pypi |
| install_cisco | Install the opt-in Cisco skill-scanner dependency used by this repo | no | false |
| submission_enabled | Open submission issues for awesome-list and registry automation when the plugin clears the submission threshold | no | false |
| submission_score_threshold | Minimum score required before a submission issue is created | no | 80 |
| submission_repos | Comma-separated GitHub repositories that should receive the submission issue | no | hashgraph-online/awesome-codex-plugins |
| submission_token | Required when submission_enabled is true; use a token with issues:write access to the submission repositories | no | "" |
| submission_labels | Comma-separated labels to apply when creating submission issues | no | plugin-submission |
| submission_category | Listing category to include in the submission issue body | no | Community Plugins |
| submission_plugin_name | Override the plugin name used in the submission issue | no | "" |
| submission_plugin_url | Override the plugin repository URL used in the submission issue | no | "" |
| submission_plugin_description | Override the plugin description used in the submission issue | no | "" |
| submission_author | Override the plugin author used in the submission issue | no | "" |
| pr_comment | PR comment mode: auto, always, or off | no | auto |
| pr_comment_style | PR comment style: concise or detailed | no | concise |
| pr_comment_max_findings | Maximum findings to include in PR comment summaries | no | 5 |
Outputs
| name | description |
|---|---|
| score | The numeric score (0-100) |
| grade | The letter grade (A-F) |
| grade_label | The human-readable grade label |
| policy_pass | Whether the selected policy profile passed |
| verify_pass | Whether runtime verification passed |
| max_severity | The most severe finding in the scan result, or none |
| findings_total | The total number of findings across all severities |
| report_path | The path to the rendered report file, if output was requested |
| registry_payload_path | The path to the machine-readable plugin ecosystem payload file, if requested |
| submission_eligible | Whether the plugin met the submission threshold and passed the configured severity gate |
| submission_performed | Whether a submission issue was created or reused |
| submission_issue_urls | Comma-separated URLs for submission issues created or reused |
| submission_issue_numbers | Comma-separated issue numbers for submission issues created or reused |
| action_exit_code | Action execution exit code |
| pr_comment_status | PR comment status: created, updated, unchanged, skipped, or disabled |
| pr_comment_id | Created or updated PR comment id when available |
| pr_comment_url | Created or updated PR comment URL when available |