jimakennedy/NFR Review

Run nfr-review on a repository and post a RAG summary to the PR

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Jul 10, 2026
License
Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned
uses: jimakennedy/nfr-review@c7492cfca0523e4de16779df8d0b6bc66e489da8 # v0.3.1

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
pathPath to the repository to scan (alias: target)no.
targetDeprecated — use 'path' insteadno""
configPath to nfr-review.yaml config fileno""
baselinePath to baseline JSONL for diff modeno""
fail-onFailure threshold: 'red' (default), 'red+amber', or 'never'nored
fail-on-redDeprecated — use 'fail-on' instead. Kept for backward compat.no""
sarifOverride path for SARIF output fileno""
sarif-uploadWhether to upload SARIF to GitHub Security tabnofalse
commentWhether to post a PR comment with resultsnotrue
create-issuesWhether to sync GitHub issues for findingsnofalse
file-issuesDeprecated — use 'create-issues' insteadno""
issue-severityMinimum severity for issue filing (critical, high, medium, low, info)nohigh
rag-minMinimum RAG level for issue filing (red, amber, green)noamber
extra-labelsComma-separated extra labels for filed issuesno""
first-run-capMax issues to create on the first sync (prevents flooding)no25
python-versionPython version to use (pip mode only, ignored in container mode)no3.12
executionExecution mode: 'pip' installs via pip, 'container' uses pre-built Docker imagenopip
imageDocker image for container mode (default: ghcr.io/jimakennedy/nfr-review:latest)noghcr.io/jimakennedy/nfr-review:latest
workersNumber of parallel collector threads (1 = sequential)no4
originFilter findings by origin: first_party, dependency, or empty for allno""
anthropic-api-keyAnthropic API key for LLM features (executive summary, ADR drift, PII detection). Omit to skip LLM features gracefully.no""
namedescription
findings-countTotal number of findings
red-countNumber of red findings
amber-countNumber of amber findings
green-countNumber of green findings
exit-codeExit code of the nfr-review run (0=pass, 2=threshold exceeded)
sarif-pathPath to the generated SARIF file (empty if sarif-upload is false)
jsonl-pathPath to the generated JSONL findings file
issues-createdNumber of GitHub issues created
issues-updatedNumber of GitHub issues updated
issues-closedNumber of GitHub issues closed