| path | Path to the repository (or subdirectory) to scan. | no | . |
| mode | scan (full repository) or diff (compare two refs). | no | scan |
| base-ref | Base git ref for diff mode (e.g. origin/main). | no | "" |
| head-ref | Head git ref for diff mode (e.g. HEAD). | no | "" |
| config | Path to an AgentReady config file. | no | "" |
| fail-on-severity | Fail when a finding at or above this severity is present: off, info, warning, or error. | no | error |
| fail-on-regression | In diff mode, fail when new error/warning regressions are introduced. | no | false |
| min-score | Fail when the readiness score is below this value (0-100). Empty disables the gate. | no | "" |
| policy | Policy pack applying severity adjustments before gating: default (no-op), enterprise (stricter instruction/install/deploy gates), oss (stricter contribution-onboarding gates), or ml-scientific (relaxed large-fixture/lint gates). Raw findings/score are never mutated; see docs/product/policy-packs.md. | no | default |
| job-summary | Write the markdown report to the GitHub Actions job summary. | no | true |
| pr-comment | Post (and update in place) a sticky pull-request comment with the markdown report. Requires github-token with pull-requests: write and a pull_request-triggered run. Fail-open: commenting problems warn but never fail the action. | no | false |
| pr-comment-condition | When to post the PR comment: on-findings (default — comment only when there are new findings/regressions, staying silent on clean runs but still updating a prior comment to its resolved state) or always (post on every run, including clean ones). | no | on-findings |
| github-token | Token used to post the PR comment (needs pull-requests: write). Defaults to the workflow GITHUB_TOKEN. Only used when pr-comment is enabled. | no | ${{ github.token }} |
| upload-sarif | Write a SARIF report alongside the JSON/markdown reports. | no | false |
| output-dir | Directory the report artifacts are written to. | no | .agentready |
| tool-version | Tool version recorded in the SARIF driver. | no | "" |
| analyze | Run the optional LLM analytics layer after the deterministic gates. Requires a provider (e.g. GitHub Models via AGENTREADY_USE_GITHUB_MODELS=1 + GITHUB_TOKEN with models: read). Off by default; absent a provider it runs deterministic-only. | no | false |
| analyze-min-score | Fail when the augmented score is below this value (0-100). Empty disables the augmented-score gate. Only meaningful with analyze enabled. | no | "" |