optimesh-ai/RuleHawk firewall gate
Multi-vendor firewall config auditor: finds dead rules and dangerous exposure, proves it with witness packets.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| configs | Files or globs to audit, whitespace/newline separated (recursive ** is supported). Example: "firewall/**/*.conf network/acls/*.acl". | yes | — |
| policy | Path to a segmentation policy JSON (zones + must_not_reach). Omit to run hygiene checks only. | no | "" |
| fail-on | Fail the check at this severity or worse: critical | high | medium | low | none | no | high |
| vendor | Force a vendor for every file: auto | ios | junos | panos | iptables | nxos | eos | no | auto |
| comment | Post/update a single sticky PR comment with the findings (true|false) | no | true |
| upload-sarif | Upload SARIF to GitHub code scanning so each finding is annotated on the exact line in the PR diff (true|false). Needs code scanning enabled and `security-events: write`. | no | true |
| working-directory | Directory to run the audit in | no | . |
| python-version | Optional Python to set up (RuleHawk needs >=3.9). Leave empty to use the python3 already on the runner — that is the fast path (no setup step). | no | "" |
Outputs
| name | description |
|---|---|
| passed | true when no finding met the fail-on threshold |
| score | Lowest hygiene score (0-100) across the audited files |
| worst-severity | Highest severity found: critical | high | medium | low | none |
| sarif-file | Path to the generated SARIF report |