| api_key | API key for O3 Security authentication (store in GitHub Secrets) | no | "" |
| server_url | O3 Security API URL | no | https://api.o3.security/graphql |
| project_name | Project name for grouping results in the O3 Security dashboard | no | "" |
| policy | Egress enforcement mode:
audit — monitor and log all outbound connections (default, safe)
block — drop TCP 80/443 connections not in the allowlist below
| no | audit |
| allowed_domains | Allowed outbound domains when policy=block.
One per line, or comma-separated. Supports host:port (e.g. api.github.com:443)
and plain hostnames (allows both 80 and 443).
| no | "" |
| allowed_ips | Allowed outbound IPs when policy=block.
One per line, or comma-separated (e.g. 1.1.1.1).
| no | "" |
| allowed_cidrs | Allowed outbound IP ranges when policy=block.
One per line, or comma-separated CIDR notation (e.g. 10.0.0.0/8).
| no | "" |
| patterns | Secret scanning patterns. Accepts either:
1. A file path: .github/secure-ci-patterns.yaml
2. Inline YAML content (use | for multiline):
- id: aws_key
regex: 'AKIA[0-9A-Z]{16}'
- id: github_token
regex: 'ghp_[A-Za-z0-9]{36}'
| no | — |
| splunk_url | Splunk HEC URL for direct SIEM integration | no | — |
| splunk_token | Splunk HEC token (store in GitHub Secrets) | no | — |
| es_url | Elasticsearch cluster URL | no | — |
| es_index | Elasticsearch index name | no | — |
| es_user | Elasticsearch username | no | — |
| es_pass | Elasticsearch password (store in GitHub Secrets) | no | — |
| fail_on_error | If the scanner itself fails to start (image pull error, startup failure),
fail the build. Default false (fail-open): the action warns and the build
continues — a registry hiccup should not break your pipeline. Set true to
require the scanner to be running.
| no | false |
| print_only | Print captured events to stdout only — skip upload to O3 backend (useful for testing) | no | false |
| debug | Enable verbose debug logging | no | false |
| docker_image | Override the Secure CI Docker image (for air-gapped environments) | no | asia-south1-docker.pkg.dev/o3-public-artifacts/o3-public/roc |
| baseline_enabled | Enable automated egress baseline — flags new destinations not seen in previous runs (uses GitHub Actions Cache) | no | true |
| runtime_security | Also deploy the KAYO runtime security agent alongside Secure CI. KAYO uses
eBPF kprobes to detect attacks at the kernel level (filesystem access,
process exec, network egress) and uploads detections to the same
O3 Security backend. Rules are fetched from the backend using the
project_name above.
| no | false |
| runtime_security_image | Override the KAYO Docker image | no | asia-south1-docker.pkg.dev/o3-public-artifacts/o3-public/kayo:latest |