lab700xorg/AIsbom Security Scanner
Deep introspection of ML model artifacts for malware, license risk, and silent drift. Posts a PR comment summarizing findings with a link to the hosted viewer.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| directory | Directory to scan for AI model artifacts. | yes | . |
| output-file | Path to save the generated SBOM JSON file. | no | sbom.json |
| github-token | GitHub token used to post the PR comment. Defaults to the workflow-provided token. Requires `pull-requests: write` permission on the consuming workflow. | no | ${{ github.token }} |
| max-rows | Maximum number of artifacts to list in the PR comment findings table. Overflow collapses into a "+ N more findings" row. | no | 10 |
| comment-on-clean | Post the PR comment even when no CRITICAL or HIGH findings were detected. Set to "false" to keep clean PRs silent. | no | true |
| fail-on-risk | Exit the job with a non-zero status when CRITICAL findings are detected (matches the CLI default). Set to "false" to make scans informational only. | no | true |
| token | Optional. Per-repo API token for posting the generated SBOM to your hosted inventory dashboard at app.aisbom.io. Leave unset for purely local PR-comment behavior. Get a token at https://app.aisbom.io/connect. | no | "" |
| platform-url | Override for the platform webhook URL. Only meaningful when `token:` is set. | no | https://app.aisbom.io |
| fail-on-platform-error | Default false. When true, a failed upload fails the CI job. | no | false |
Outputs
| name | description |
|---|---|
| sbom-path | Path to the generated SBOM JSON file (relative to the workspace). |
| share-url | Hosted viewer URL for the scanned SBOM (empty if --share was rejected or upload failed). |