leakferrethq/leakferret
Context-aware secret scanning with provider-verified findings and SARIF upload.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | leakferret version to install (e.g. "0.1.1"). Use "latest" for the most recent release. | no | latest |
| path | Path to scan, relative to the repo root. | no | . |
| verify-mode | one of: none, best-effort, only-verified, ever-verified. | no | best-effort |
| format | Output format: pretty, json, sarif. SARIF is what GitHub Code Scanning ingests. | no | sarif |
| fail-on | Severity threshold to fail the run (low | medium | high | critical | any). "any" fails on any REAL finding. | no | any |
| baseline-path | Path to the baseline file (relative to the repo root). Defaults to `.leakferret-baseline.json`. | no | .leakferret-baseline.json |
| upload-sarif | Upload SARIF to GitHub Code Scanning (true / false). | no | true |
| category | SARIF category (lets multiple leakferret runs coexist in Code Scanning). | no | leakferret |
| github-token | Token for fetching binaries on rate-limited runners. | no | ${{ github.token }} |
| verify-signature | Verify the downloaded binary's keyless cosign signature against the leakferret release workflow identity (true / false). | no | true |
Outputs
| name | description |
|---|---|
| findings-count | Total number of findings. |
| verified-count | Number of findings verified live by a provider. |
| sarif-path | Path to the generated SARIF file. |