nipuni-udari/CredHunter-X
Scan a repository for hardcoded secrets with Gitleaks, then classify, rank, explain, and propose remediation for each finding with CredHunter-X's rule-based engine and on-by-default LLM pipeline (which falls back to the deterministic engine when no OPENAI_API_KEY is present). Writes a SARIF report, a JSON report, and a job summary, and fails the job on findings at or above the configured risk level.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| scan_path | Path within the repository to scan. | no | . |
| config | Path (relative to the repo root) to a .credhunter.yml config. Optional; sensible defaults are used if absent. | no | .credhunter.yml |
| fail_on | Risk level that fails the job (low | medium | high | critical). | no | high |
| enable_llm | Run the LLM pipeline (classify -> rank -> explain -> remediate). On by default; it only calls OpenAI when the OPENAI_API_KEY env var is present on the step, otherwise every stage falls back to the deterministic engine. Set to "false" to force deterministic-only even when a key is available. | no | true |
| llm_workflow | Classifier workflow when the LLM runs (single | agentic). | no | single |
| llm_rank | Run the LLM Ranker stage (refines the risk score). | no | true |
| llm_explain | Run the LLM Explainer stage (developer-facing rationale). | no | true |
| llm_remediate | Run the LLM Remediation stage (context-specific fix steps). | no | true |
| gitleaks_version | Gitleaks release version to download. | no | 8.18.4 |
| python_version | Python version used to run CredHunter-X. | no | 3.11 |
Outputs
no outputs