luckypipewrench/Pipelock Agent Security Scan
Scan your project for AI agent security risks. Pattern-based detection of credentials and misconfigurations with tailored config generation. See docs for coverage details.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 11, 2026
- License
- Apache 2.0
Pinned Snippet
uses: luckypipewrench/pipelock@9d2e37d296359c38e599525a0424cdc189a812e1 # v3.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Pipelock version to use. Defaults to latest release. | no | latest |
| config | Path to pipelock config file. If not set, runs audit to generate one. | no | "" |
| directory | Directory to scan. Defaults to workspace root. | no | . |
| scan-diff | Scan the PR diff for leaked secrets (requires fetch-depth: 0). | no | true |
| fail-on-findings | Fail the action if critical findings are detected. | no | true |
| test-vectors | Run built-in test vectors to validate scanning coverage. | no | true |
| exclude-paths | Paths to exclude from findings (one per line). Supports globs (*.generated.go) and directory prefixes (vendor/). | no | "" |
Outputs
| name | description |
|---|---|
| score | Risk score (0-100) based on pattern-matched findings. Higher means more issues detected. Not an absolute security rating. |
| findings-count | Total number of findings. |
| critical-count | Number of critical findings. |
| config-path | Path to the config used (user-provided or auto-generated). |
| audit-failed | Whether the audit command itself failed to run (fail-closed). |