| license-key | CDK Insights license key (required for AI analysis) | no | "" |
| working-directory | Directory containing CDK project | no | . |
| stack-name | Specific stack to analyze (optional, analyzes all by default) | no | "" |
| ai-analysis | Enable AI-powered analysis (requires license-key to be set) | no | false |
| fail-on | Fail workflow on severity levels (comma-separated: critical,high,medium,low) | no | "" |
| fail-on-pillars | Which WAF pillars count toward fail-on. Reliability, Cost, and Best-Practice findings are reported but do not block the deploy unless included here. Accepts a comma-separated list of "security", "reliability", "cost optimization", "operational excellence", "performance efficiency", "sustainability", or the shorthand "all". Default: security. | no | security |
| fail-on-class | Fail the build on findings of these classes, regardless of severity or pillar. Comma-separated list of "security", "best-practice", "compliance". Orthogonal to fail-on / fail-on-pillars — block on real risk while best-practice advice stays non-blocking. Requires cdk-insights >= 1.44.1 (the finding-class axis); older CLIs emit no class data, so the gate never fires. Default: empty (gate off). | no | "" |
| pr-comment | Post analysis summary as PR comment | no | true |
| sarif-upload | Generate SARIF file and upload to GitHub Code Scanning (requires security-events: write permission) | no | false |
| services | Filter analysis to specific AWS services (comma-separated) | no | "" |
| rule-filter | Filter to specific rules (comma-separated rule IDs) | no | "" |
| upload-artifact | Upload report files (JSON, SARIF, markdown) as a GitHub artifact | no | true |
| artifact-name | Name for the uploaded artifact | no | cdk-insights-report |
| github-token | GitHub token for SARIF upload to Code Scanning (default: automatic) | no | ${{ github.token }} |
| cdk-insights-version | Specific version of cdk-insights to use (default: latest) | no | latest |