kuzivaai/Regula AI Governance Check

Scan code for EU AI Act risk patterns. 419 patterns, 8 languages, zero data transmission. Your code never leaves your machine.

Trust Signals

workflow.ymlSHA-pinned

uses: kuzivaai/getregula@359423e7faeab5625d083fe15eb5911a619bac81 # v1.7.1

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
path	Path to the project to scan	no	.
comment-on-pr	Post a compliance summary comment on pull requests	no	true
inline-pr-comments	Post per-finding inline review comments on the PR diff (only for findings on changed lines)	no	false
inline-comment-max	Maximum number of inline review comments to post per PR (avoid spam)	no	20
inline-comment-min-tier	Minimum tier for inline comments (prohibited\|high_risk\|limited_risk\|minimal_risk)	no	high_risk
format	Output format for findings (sarif or json)	no	sarif
framework	Compliance framework to check against	no	eu-ai-act
fail-on-prohibited	Exit with code 2 if prohibited-use findings are detected	no	true
fail-on-high-risk	Exit with code 1 if high-risk findings are detected	no	false
min-dependency-score	Minimum acceptable pinning score (0–100). Exit with code 1 if below threshold.	no	0
diff-mode	Only scan files changed in this PR (compares against base branch)	no	false
upload-sarif	Upload SARIF results to GitHub Code Scanning	no	true
allow-partial-scan	Accept a scan that skipped unreadable/unparseable files (completion_status="completed_with_skips"). Default "false" fails the gate closed, because "0 findings" cannot cover files that were not analysed. Set "true" only if you understand the risk.	no	false
annotations	Emit GitHub workflow command annotations (::error, ::warning, ::notice) for each finding so they appear inline on the PR "Files changed" tab. Works without SARIF/CodeQL. Set to "false" to disable.	no	true

name	description
findings-count	Total number of findings
prohibited-count	Number of prohibited-use findings
high-risk-count	Number of high-risk findings
pinning-score	Dependency pinning score (0��100)
sarif-file	Path to the generated SARIF file
manifest-file	Path to the AnalysisManifest proving scan completion (DEF-004)