| sentinelayer_token | Sentinelayer service token used to authorize run orchestration | yes | "" |
| status_poll_token | Optional token for status polling when wait_for_completion=true | no | "" |
| sentinelayer_api_url | Sentinelayer API base URL | no | https://api.sentinelayer.com |
| scan_mode | Scan mode command mapper: baseline, deep, audit, full-depth | no | deep |
| severity_gate | Minimum severity to block merge: P0, P1, P2, or none | no | P1 |
| github_token | Optional GitHub token retained for workflows that pin the full Omar model contract | no | "" |
| sentinelayer_managed_llm | Use Sentinelayer-managed LLM routing for backend adjudication metadata | no | true |
| model | Primary LLM model requested for backend adjudication metadata | no | gpt-5.3-codex |
| model_fallback | Fallback LLM model requested for backend adjudication metadata | no | gpt-4.1-mini |
| use_codex | Request Codex-capable adjudication path when backend supports model policy metadata | no | true |
| codex_only | Request Codex-only adjudication path when backend supports model policy metadata | no | false |
| codex_model | Codex model requested for backend adjudication metadata | no | gpt-5.3-codex |
| llm_failure_policy | Failure policy for requested LLM adjudication metadata: block, warn, ignore, or deterministic_only. deterministic_only gates on action-local deterministic findings and publishes a backend App check only after the local gate passes. | no | block |
| provider_installation_id | Optional GitHub App installation id override | no | "" |
| command | Optional explicit slash command override (example: /omar baseline) | no | "" |
| sentinelayer_spec_hash | Optional Sentinelayer spec hash (64-char hex) to bind run governance context | no | "" |
| sentinelayer_spec_id | Optional Sentinelayer spec UUID associated with sentinelayer_spec_hash | no | "" |
| spec_binding_mode | Spec binding mode: none, explicit, auto_discovered | no | none |
| wait_for_completion | Wait for managed run completion before exiting | no | true |
| wait_timeout_seconds | Max wait time for run completion | no | 900 |
| wait_poll_seconds | Polling interval for run status checks | no | 10 |
| pr_number | Optional PR number override (useful for workflow_dispatch) | no | "" |
| playwright_mode | Optional Playwright profile: off, baseline, or audit | no | off |
| playwright_node_version | Node.js version used when Playwright mode is enabled | no | 20 |
| playwright_base_url | Optional PLAYWRIGHT_TEST_BASE_URL override passed to Playwright command | no | "" |
| playwright_bootstrap | When true, run npm ci + playwright browser install before executing Playwright command | no | true |
| playwright_baseline_command | Command executed for playwright_mode=baseline | no | npm run test:e2e:baseline |
| playwright_audit_command | Command executed for playwright_mode=audit | no | npm run test:e2e:audit |
| sbom_mode | Optional SBOM profile: off, baseline, or audit | no | off |
| sbom_bootstrap | When true, install SBOM generator prerequisites before default SBOM commands | no | true |
| sbom_output_dir | Output directory for SBOM artifacts | no | .sentinelayer/sbom |
| sbom_baseline_command | Optional command override for sbom_mode=baseline (empty uses default CycloneDX generation profile) | no | "" |
| sbom_audit_command | Optional command override for sbom_mode=audit (empty uses default CycloneDX generation profile) | no | "" |
| local_gates_enabled | When true, run the action-local Omar Gate 2.0 gate runner (static + security) before the backend bridge. Writes FINDINGS.jsonl to local_gates_output_dir. Defaults to true — set to "false" explicitly if you want the legacy backend-only flow. | no | true |
| local_gates_output_dir | Directory for FINDINGS.jsonl emitted by the local gate runner (when local_gates_enabled=true) | no | .omargate/local |
| local_gates_fail_severity | Minimum severity that causes the local gate runner to exit non-zero: P0, P1, P2, P3, or never | no | P1 |
| local_gates_policy_path | Optional .sentinelayer policy file path. Empty auto-discovers .sentinelayer/policy.yaml, .sentinelayer/policy.yml, then .sentinelayer/policy.json. | no | "" |
| local_gates_persona_dispatch | When true, let the local gate runner dispatch persona reviews through create-sentinelayer for scaffold-mapped findings. Defaults to false so existing workflows remain deterministic unless they opt in. | no | false |
| local_gates_persona_cli_path | Optional path to the create-sentinelayer CLI used for local persona dispatch. Empty uses PATH discovery. | no | "" |
| local_gates_persona_dispatch_dry_run | When true, evaluate persona routing and include the dispatch summary without spawning persona review commands. | no | false |
| local_gates_persona_strict_sandbox | When true, run persona dispatch subprocesses through the strict OS sandbox envelope and fail visibly if sandboxing is unavailable or the persona command fails. | no | false |
| artifact_name_suffix | Optional suffix appended to the uploaded findings artifact name; useful when invoking this action more than once in a workflow run | no | "" |