ironsecco/IronClaw sandbox scan

Grade a container / compose / k8s sandbox isolation posture 0-100 and post a sticky PR scorecard.

Trust Signals

name	description	required	default
target	What to scan: a running container name/id (mode=container), or a path to a compose/k8s file (mode=compose\|k8s).	yes	—
mode	Scan mode: container \| compose \| k8s.	no	container
service	Compose service name (required only when mode=compose and the file has more than one service).	no	""
min-score	Fail the check when the containment score is below this (0-100). 0 = report-only (default).	no	0
policy-check	Policy-as-code gate (mode=k8s only): evaluate the manifest against the rules --emit-policy would generate and fail the check on any violation. Independent of min-score; needs no cluster or admission controller. Default false.	no	false
comment	Post the scorecard as a sticky comment on the pull request (true/false).	no	true
badge	Write and upload the shareable SVG badge as a build artifact (true/false).	no	false
upload-sarif	Emit SARIF and upload it to GitHub code scanning so failed dimensions appear in the Security tab (true/false). Requires `permissions: security-events: write` in the calling workflow. Default false so the action needs no extra permission unless you opt in.	no	false
version	ironctl release to use: a tag like v0.1.252, or "latest" (default).	no	latest
github-token	Token used to post the PR comment and resolve the latest release. Defaults to the workflow token.	no	${{ github.token }}

name	description
score	The overall containment score (0-100).
grade	The letter grade (A-F).
scorecard	Path to the rendered markdown scorecard.
badge-path	Path to the SVG badge (only when badge=true).
sarif-path	Path to the SARIF log (only when upload-sarif=true).
passed	true when the score met min-score (or min-score was 0).
policy-passed	true when the policy-as-code check passed (or policy-check was off). Only meaningful when policy-check=true.