microsoft/KQL Guard

Lint KQL detection rules for syntax errors and performance anti-patterns. Outputs SARIF v2.1.0 for GitHub Code Scanning.

Trust Signals

name	description	required	default
mode	How to obtain the binary: download (default, fetch release asset), docker (run ghcr image), or prebuilt (use a locally-built binary).	no	download
version	Release tag / image tag to use for download and docker modes. Defaults to the latest release.	no	latest
path	File or directory to scan. Directories are searched recursively for *.kql files.	no	.
format	Output format: sarif (default), text, or json.	no	sarif
max-cost	Fail the scan when a query's estimated cost exceeds this value. Empty = no cost gate.	no	""
schema	Path to a schema.json for schema-aware validation. Empty = skip.	no	""
args	Raw arguments appended verbatim to the kql-guard invocation (escape hatch).	no	""
working-directory	Directory to run from. Defaults to the workspace root.	no	""
fail-on-violations	When true, the action fails the job when kql-guard exits 1 (errors, --max-cost breach, or --strict findings). When false (default), it only sets the exit-code output. Cost warnings are advisory — pass --max-cost or --strict via args to gate on them.	no	false
prebuilt-path	prebuilt mode only: path to the locally-built binary. Defaults to bin/Release/net10.0/<rid>/publish/kql-guard.	no	""

name	description
sarif-file	Path to the written SARIF file (empty unless format=sarif).
exit-code	kql-guard exit code: 0 clean/advisory, 1 errors or --max-cost/--strict gate, 2 usage error.