hatyibei/Shingan — AI Agent Workflow Static Analyzer

AIエージェントワークフローを実行前に静的解析し、無限ループ・コスト爆発・PII漏洩経路を検出

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 19, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: hatyibei/shingan@71601403367892854e7f94c1748917e8ed2fd602 # v0.9.1

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
format	Input format (json / adk-go / samurai)	no	adk-go
input	Workflow file or directory to analyze	yes	—
output	Output format (json / markdown / sarif)	no	sarif
output-file	Optional output file path. Default: stdout for json/markdown, shingan.sarif for sarif	no	""
fail-on	Exit non-zero on this Severity or higher (critical / warning / info / never)	no	critical
baseline-file	Optional path to a baseline JSON produced by --save-baseline. When set, findings already present in the baseline are suppressed (progressive adoption).	no	""
since	Optional git ref (e.g. main). When set, only files changed since this ref are analyzed.	no	""
policy-file	Optional path to .shingan.yaml policy file. Default: walk up from CWD looking for .shingan.yaml	no	""
pr-comment	Post a sticky markdown comment on the PR summarising findings. Requires `permissions: pull-requests: write` and a pull_request trigger.	no	false
pr-comment-mode	Controls when the PR comment is posted: 'always' / 'on-findings' (only when total>0) / 'on-failure' (only when fail-on threshold tripped).	no	on-findings

Outputs

name	description
exit-code	0=no findings or Info only, 1=Warning detected, 2=Critical detected
findings-count	Total number of findings