jimakennedy/NFR Review
Run nfr-review on a repository and post a RAG summary to the PR
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- Apache 2.0
Pinned Snippet
uses: jimakennedy/nfr-review@c7492cfca0523e4de16779df8d0b6bc66e489da8 # v0.3.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to the repository to scan (alias: target) | no | . |
| target | Deprecated — use 'path' instead | no | "" |
| config | Path to nfr-review.yaml config file | no | "" |
| baseline | Path to baseline JSONL for diff mode | no | "" |
| fail-on | Failure threshold: 'red' (default), 'red+amber', or 'never' | no | red |
| fail-on-red | Deprecated — use 'fail-on' instead. Kept for backward compat. | no | "" |
| sarif | Override path for SARIF output file | no | "" |
| sarif-upload | Whether to upload SARIF to GitHub Security tab | no | false |
| comment | Whether to post a PR comment with results | no | true |
| create-issues | Whether to sync GitHub issues for findings | no | false |
| file-issues | Deprecated — use 'create-issues' instead | no | "" |
| issue-severity | Minimum severity for issue filing (critical, high, medium, low, info) | no | high |
| rag-min | Minimum RAG level for issue filing (red, amber, green) | no | amber |
| extra-labels | Comma-separated extra labels for filed issues | no | "" |
| first-run-cap | Max issues to create on the first sync (prevents flooding) | no | 25 |
| python-version | Python version to use (pip mode only, ignored in container mode) | no | 3.12 |
| execution | Execution mode: 'pip' installs via pip, 'container' uses pre-built Docker image | no | pip |
| image | Docker image for container mode (default: ghcr.io/jimakennedy/nfr-review:latest) | no | ghcr.io/jimakennedy/nfr-review:latest |
| workers | Number of parallel collector threads (1 = sequential) | no | 4 |
| origin | Filter findings by origin: first_party, dependency, or empty for all | no | "" |
| anthropic-api-key | Anthropic API key for LLM features (executive summary, ADR drift, PII detection). Omit to skip LLM features gracefully. | no | "" |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings |
| red-count | Number of red findings |
| amber-count | Number of amber findings |
| green-count | Number of green findings |
| exit-code | Exit code of the nfr-review run (0=pass, 2=threshold exceeded) |
| sarif-path | Path to the generated SARIF file (empty if sarif-upload is false) |
| jsonl-path | Path to the generated JSONL findings file |
| issues-created | Number of GitHub issues created |
| issues-updated | Number of GitHub issues updated |
| issues-closed | Number of GitHub issues closed |