jasonrve/TerraSec
Call an OpenAI-compatible LLM with a security-focused prompt, render a well-formatted Markdown report, and optionally upsert it as a PR comment.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| prompt | Primary instruction for the LLM. | yes | — |
| context | Optional additional context to include with the prompt. | no | "" |
| llm_base_url | OpenAI-compatible LLM base URL. | no | "" |
| llm_api_key | OpenAI-compatible LLM API key. | no | "" |
| github_token | GitHub token used to upsert PR comments. | no | ${{ github.token }} |
| model | Model name to use. | no | openai/gpt-4o-mini |
| pr_number | Pull request number to comment on. Defaults to the current PR context when available. | no | "" |
| post_comment | Whether to upsert a PR comment. | no | true |
| fail_on_findings | Fail the step when the generated report contains findings or a non-pass verdict. | no | false |
| comment_marker | Stable HTML marker used to update one comment instead of spamming duplicates. | no | <!-- terrasec --> |
| dry_run | Skip posting a PR comment and only emit outputs. | no | false |
| mock_response_file | Optional path to a file containing a raw OpenAI-style response payload for validation. | no | "" |
| context_mode | Context strategy to use. diff, full, hybrid, or agentic. | no | diff |
| extra_context_paths | Comma or newline separated list of file paths to always include. | no | "" |
| max_file_chars | Maximum characters to load per file. | no | 12000 |
| max_follow_up_rounds | Maximum number of additional file-request rounds in agentic mode. | no | 1 |
Outputs
| name | description |
|---|---|
| verdict | The parsed verdict from the model. |
| finding_count | Number of findings in the report. |
| comment_body | Rendered Markdown comment body. |
| comment_url | URL of the upserted PR comment, if any. |