physshell/Owen lifetime/resource check
Scan C# for lifetime/resource leaks the compiler cannot express — event/timer subscription leaks, undisposed IDisposable fields/locals, ignored Subscribe() tokens, ArrayPool buffers rented-but-never-returned — and annotate the PR.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 11, 2026
- License
- None
Pinned Snippet
uses: physshell/own.net@b1ee9619a6ebda69821faed6e4dcc5631eaef9aa # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | File(s) or directory to scan (directories are walked for *.cs). | no | . |
| config | Explicit Owen configuration file (own.toml). Today it carries the P-035 [weak-subscription].subscribe allowlist of your project's own weak-subscribe wrapper API ("SimpleType.Method"); a matching call is treated as an already- released subscription. Left empty, no config is read. | no | "" |
| format | Finding surface: github (PR annotations), msbuild, human, or sarif — a SARIF 2.1.0 log for GitHub code scanning, written to a file and exposed as the sarif-file output (feed it to github/codeql-action/upload-sarif). | no | github |
| severity | How findings are shown: error (default) or warning (advisory). | no | error |
| fail-on-finding | Fail the step when any leak is found. | no | true |
| python-version | Python version for the Owen core. | no | 3.13 |
| dotnet-version | The .NET SDK version for the Roslyn extractor. | no | 8.0.x |
| sarif-file | Where to write the SARIF log when format: sarif (default: $RUNNER_TEMP/owen.sarif). The chosen path is echoed back as the sarif-file output regardless. | no | "" |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the SARIF 2.1.0 log — set only when format: sarif. Hand it to github/codeql-action/upload-sarif to publish to code scanning. |