ndevu12/StayAwakeBot Strix

Hunt supply-chain worm indicators — obfuscated loaders, fake fonts, VS Code auto-run, evil merges — and fail CI.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
version	stayawakebot version from PyPI; blank = latest. Pin in production.	no	""
config-file	Repo-relative path to your committed `saw` config whose `settings` and `allowlist` govern the scan — the single source of truth; Strix adds no settings of its own. Defaults to the conventional `config/security.yml` when your repo ships one; otherwise the scanner's built-in defaults are used.	no	""
fail-on	Verdict tier that turns the gate red. 'infected' (default) fails only on a confirmed infection. 'suspicious' also fails on suspect-tier findings — e.g. a historical evil merge still in the commit graph after the tree itself was cleaned. 'never' reports without gating on the verdict (outputs and the step summary still carry it). Scan infrastructure failures — no target scanned, an errored target, an unparseable report, a usage error — fail the job REGARDLESS of this input: a security gate must never read a non-scan as clean. To soften those too, use GitHub's native `continue-on-error: true` on the step.	no	infected
require-db	'true' passes --require-db so the scan fails instead of silently degrading to the inline malware seed when the offline advisory DB is absent or fails its integrity check — for gates that must not lose coverage without noticing.	no	false
remediate	'pr' runs `saw fix --pr` after an infected verdict: saw rebuilds the fix in an isolated worktree off the remote's default branch, pushes the stable `security/auto-clean` branch, and opens/updates ONE rolling PR per repo (never committing to the default branch itself). The gate STAYS RED — remediation is a courtesy, and only a clean tree turns the check green. Requires `contents: write` and `pull-requests: write` permissions plus the repository setting "Allow GitHub Actions to create and approve pull requests". Without push access saw degrades down its fallback ladder (fork PR, else a git-am-able patch in sab-patches/ plus a deduplicated issue) — the step summary says which happened. Default 'off'.	no	off
github-token	Token used by `remediate: pr` (push the fix branch / open the PR) and by the opt-in `pr-comment` step. Defaults to the workflow token; pass a PAT or GitHub App token instead if the fix PR itself must trigger your CI (events created with the default GITHUB_TOKEN don't start workflows).	no	${{ github.token }}
upload-sarif	'true' uploads the scanner's redacted SARIF 2.1.0 report to GitHub code scanning, so findings appear in the Security tab and as inline annotations on the exact line. Purely additive — it never changes the gate. Requires `security-events: write` on the job (grant it ONLY when you enable this; do not blanket-grant). Degrades to a notice — never a failure — when the scanner is too old to emit SARIF, on a fork PR, or when the permission is absent. Default 'false'.	no	false
upload-artifact	'true' uploads the scanner's REDACTED reports (JSON + Markdown), the SARIF, and any `sab-patches/*.patch` as a run artifact, so the evidence travels with the run. Never uploads the full-evidence report or the raw infected file. Needs no extra permission (works on fork PRs). Note: a fix patch is a diff that removes the payload, so its removed lines contain the payload — apply it in a controlled clone. Default 'false'.	no	false
pr-comment	'true' posts (and, on re-runs, updates in place) ONE sticky pull-request comment with the per-finding remediation guidance on `pull_request` events. Additive — never changes the gate. Requires `pull-requests: write` on the job. Degrades to a notice on a fork PR or when the permission is absent. Default 'false'.	no	false

Outputs

name	description
verdict	Overall scan verdict: 'clean', 'suspicious', or 'infected'.
infected	Number of infected targets.
suspicious	Number of suspicious (but not infected) targets.
findings	Total number of findings across all targets.
report	Path to the full-evidence JSON report on the runner.
sarif	Path to the redacted SARIF 2.1.0 report on the runner, or empty when the installed scanner is too old to emit SARIF. Upload it yourself (e.g. github/codeql-action/upload-sarif) if you want code scanning but prefer to scope `security-events: write` in your own workflow.