| checkout | Run actions/checkout first. Net-new gating needs full history (fetch-depth 0). | no | true |
| fetch_depth | Checkout fetch-depth. MUST be 0 for net-new gating (merge-base). | no | 0 |
| mode | auto | pr (net-new gate) | baseline (full scan, no gate). | no | auto |
| fail_on | Severity that blocks: any | critical | high | medium | low | none. | no | any |
| precision | Net-new precision: line | file. | no | line |
| base_ref | Override the base ref/SHA (default: PR base SHA from the event). | no | "" |
| head_ref | Override the head ref/SHA (default: PR head SHA, else github.sha). | no | "" |
| strict | Fail the job if MegaLinter itself errors (a tool error, not a finding). | no | false |
| flavor | MegaLinter flavor: all (full image) | security | python | go | ... | no | all |
| megalinter_tag | MegaLinter image tag or digest to pin. | no | v8 |
| enable_linters | Comma-separated MegaLinter linter keys to enable (others off). | no | "" |
| disable_linters | Comma-separated MegaLinter linter keys to disable. | no | "" |
| incremental | PR events only: run MegaLinter over just the files the PR changes (VALIDATE_ALL_CODEBASE=false) instead of the whole repo — faster on large repos. The net-new gate still uses chargate's own diff. Baseline (push) scans are always whole-repo. Default off. | no | false |
| ignore_sops_encrypted | Ignore secret-scanner hits on SOPS-encrypted values (ENC[AES256_GCM,...]) — they are already encrypted and are 100% false positives. A plaintext secret in the same file still gates. Set to false to gate on them anyway. Default on. | no | true |
| emit_sarif_artifact | Upload the full SARIF as a build artifact. | no | true |
| sarif_artifact_name | Artifact name for the full SARIF. | no | chargate-sarif |
| upload_github_sarif | Upload the full SARIF to the GitHub Security tab (needs GHAS on private repos). | no | true |
| github_token | Token for the GitHub Security-tab SARIF upload + PR comments. Needs pull-requests: write on the consumer workflow for comments. | no | ${{ github.token }} |
| pr_comment | Post GHAS-style PR comments for net-new findings (PR events only). Needs pull-requests: write. | no | true |
| pr_comment_mode | What to post: summary (one updatable comment) | inline (per-line) | both. | no | both |
| pr_comment_max_inline | Cap on inline comments per run; the rest are listed in the summary. | no | 50 |
| pr_comment_token | Explicit override token used ONLY to author the PR comments (BYO GitHub App via actions/create-github-app-token). Usually unset: with id-token: write the token broker provides a Chargate[bot] token automatically. | no | "" |
| token_broker_url | Chargate token-broker base URL. With job permission id-token: write and the Chargate App installed, comments are authored by Chargate[bot]. Set empty to disable (fall back to github-actions[bot]). | no | https://chargate.magmamoose.com |
| oidc_audience | OIDC audience requested for the token-broker exchange (advanced). | no | chargate |
| defectdojo_url | DefectDojo base URL. Set to enable import of the FULL SARIF. | no | "" |
| defectdojo_token | DefectDojo API token (pass a secret). Used only if defectdojo_url is set. | no | "" |
| defectdojo_product | DefectDojo product name (auto-created if missing). Defaults to the repo name. | no | ${{ github.event.repository.name }} |
| defectdojo_product_type | DefectDojo product type name (used to auto-create a new product). | no | Research and Development |
| defectdojo_engagement | DefectDojo engagement name (auto-created if missing). | no | ci |
| defectdojo_close_old | Close findings no longer present on reimport. | no | true |
| dependency_track_url | Dependency-Track base URL. Set to enable the CycloneDX BOM upload (pass a Variable). | no | "" |
| dependency_track_api_key | Dependency-Track API key (pass a Secret). Needs BOM_UPLOAD (+ PROJECT_CREATION_UPLOAD for auto-create, + VIEW_PORTFOLIO for the PR-comment project link). | no | "" |
| dependency_track_project_name | Dependency-Track project name (auto-created if missing). | no | ${{ github.repository }} |
| dependency_track_project_version | Dependency-Track project version. | no | ${{ github.ref_name }} |
| dependency_track_auto_create | Auto-create the project/version on first upload. | no | true |
| python_version | Python version used to run the chargate CLI. | no | 3.12 |