nguyencongnamit/SecureVibe gate
Fail the build on secrets, vulnerable dependencies, and Dockerfile / GitHub Actions issues at or above a severity floor.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| files | Space-separated list of files to gate, e.g. "Dockerfile package-lock.json .github/workflows/ci.yml". gate scans exactly the files you name. | yes | — |
| severity-floor | Lowest severity that fails the gate: critical | high | medium | low. | no | high |
| version | npm version or dist-tag of @namncqualgo/secure-code-mcp to run (pin for reproducible CI). | no | latest |
| sarif-file | When set (e.g. "gate.sarif"), gate emits SARIF 2.1.0 to this path and the action uploads it to GitHub Code Scanning — findings appear in the Security tab and as PR annotations, and the job still fails when any finding meets the severity floor. The calling workflow needs `permissions: security-events: write` (and a package version whose gate supports `--format sarif`). Leave empty for plain text output and no upload. | no | "" |
| category | Code Scanning category for the SARIF upload; change it when one workflow uploads several SARIF files. | no | secure-code-gate |
Outputs
no outputs