mergeguide/MergeGuide Policy Check
Run MergeGuide policy checks on your code to enforce security and compliance standards
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| paths | Files or directories to check (space-separated) | no | . |
| format | Output format (text, json, sarif, markdown) | no | text |
| policy | Path to custom policy file(s) (space-separated) | no | "" |
| no-defaults | Skip default policies | no | false |
| fail-on-warning | Exit with error if warnings are found | no | false |
| sarif-file | Path to write SARIF output (for GitHub code scanning) | no | "" |
| github-token | GitHub token for uploading SARIF results | no | ${{ github.token }} |
| anthropic-api-key | BYOK (bring your own key): your Anthropic API key, supplied from a CI secret (e.g. ${{ secrets.ANTHROPIC_API_KEY }}). When set, MergeGuide runs the composed NGE deep-analysis engine (L1 + L2) instead of the default scan. The key is used ONLY to call Anthropic from within your own CI runner and is NEVER stored, logged, or transmitted to MergeGuide. Leave empty for the free, offline L1/regex scan (no key required). | no | "" |
| l2-model | Optional pinned L2 model id. Defaults to the validated model (claude-opus-4-8). Ignored when no key is supplied. Pinning a model keeps CI verdicts reproducible. | no | "" |
Outputs
| name | description |
|---|---|
| passed | Whether all checks passed (true/false) |
| violations | Number of violations found |
| report | Path to the output report file (if sarif-file specified) |