payloadguard-plg/PayloadGuard
Scans a branch before merge and tells you exactly how badly it's going to hurt.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| repo-token | GitHub token for posting PR comments | no | ${{ github.token }} |
| pr-description | PR description for semantic transparency analysis — pass github.event.pull_request.body | no | "" |
| save-markdown | Filename for the markdown report | no | payloadguard-report.md |
| app-id | GitHub App ID for Check Run posting (optional) | no | "" |
| private-key | GitHub App private key PEM contents for Check Run posting (optional) | no | "" |
| installation-id | GitHub App installation ID for Check Run posting (optional) | no | "" |
| auto-remediate | Open a PR replacing mutable action tags with pinned SHAs. Requires pull-requests: write. Never commits directly to the scanned branch. | no | false |
| runtime-mode | eBPF runtime defence agent mode: disabled | audit | block. audit emits events to pg-runtime-events.json with no blocking. block terminates processes that match egress/ptrace/procmem policies. Requires a runner with CONFIG_KPROBES and CONFIG_FTRACE enabled. The agent degrades gracefully (exit 0) on unsupported kernels. | no | disabled |
Outputs
| name | description |
|---|---|
| exit-code | PayloadGuard exit code: 0=safe, 1=error, 2=destructive |
| report-path | Absolute path to the generated markdown report |
| json-report-path | Absolute path to the generated JSON report |
| verdict | Verdict string: SAFE, REVIEW, CAUTION, or DESTRUCTIVE |
| runtime-events-path | Path to pg-runtime-events.json (only set when runtime-mode != disabled) |