| command | Command to run under Egret (monitored, and enforced in block mode). If empty, Egret is only installed so you can call `egret run` yourself. | no | "" |
| policy | Path to a policy.yaml. If omitted, safe defaults (audit mode) are used. | no | "" |
| mode | Override policy mode: audit | block. | no | audit |
| version | Egret release tag to download (e.g. v0.1.0). 'latest' resolves the newest release. | no | latest |
| sarif | Produce a SARIF report of policy violations from the run. | no | true |
| upload-sarif | Upload the SARIF to GitHub Code Scanning (requires `security-events: write` permission). | no | true |
| fail-on-violations | Fail the job if Egret records any policy violation, even in audit mode. | no | false |
| output-dir | Directory for report.json / report.md / report.sarif (default: $RUNNER_TEMP/egret/report). | no | "" |
| allow-build-from-source | If no verified release is available, build Egret from source (UNPINNED, unverified). Off by default. | no | false |
| allow-pull-request-target | Permit running under pull_request_target (Egret runs your command as ROOT - only enable if you do NOT check out the PR head). | no | false |
| disable-sudo | Block mode only: revoke the build user's passwordless sudo for the run (defence-in-depth on top of no_new_privs). Refused in audit mode (the command runs as root there). | no | false |
| ingest-url | Optional self-hosted Egret Nest dashboard ingest URL (e.g. https://nest.example.com/ingest). When set, the run's report is POSTed there. Leave empty to keep everything local (no phone-home). | no | "" |
| ingest-token | Bearer token for the ingest endpoint. Pass a GitHub Actions secret (never a literal) - it is sent as a request header, never placed on a command line. Ignored unless ingest-url is set. | no | "" |
| github-token | Token for the App-only publish features below (check-run, PR comment, dashboard issue). Pass a GitHub App installation token (via actions/create-github-app-token) for org-wide policy + branded 'egret[bot]' identity, or the built-in GITHUB_TOKEN for the default scope. Sent only as an Authorization header, never on a command line. Empty = no GitHub publishing. | no | "" |
| check-run | Publish a branded pass/fail check run summarizing the report. Requires github-token with checks: write. | no | false |
| pr-comment | Post/update a sticky comment with the report on the pull request (pull_request events only). Requires github-token with pull-requests: write. | no | false |
| dashboard-issue | Create/update the Egret Security Dashboard issue with the latest report. Requires github-token with issues: write. | no | false |