plenoai/pleno-dlp scan
Scan a checked-out repo with pleno-dlp (600+ secret detectors + PII detection) and emit a SARIF report for github/codeql-action/upload-sarif. Downloads the pinned GoReleaser release binary for the runner's OS/arch and cosign-verifies checksums.txt (Sigstore keyless) plus the archive checksum before executing anything.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Path to scan (passed to `pleno-dlp scan filesystem`). | no | . |
| version | pleno-dlp release tag to install, e.g. "v0.59.0". Defaults to this action's own tag ref, so the action revision and the binary it runs are always the same signed release. Required when invoked via a local/branch ref (e.g. `uses: ./`) where no tag is resolvable. | no | "" |
| args | Extra space-separated arguments appended to the scan command. | no | "" |
| sarif-file | Path to write the SARIF report. | no | pleno-dlp-results.sarif |
| fail-on | Minimum severity that fails the step: any|info|low|medium|high|critical (default high: audit-first — see `pleno-dlp scan --help`). | no | high |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF report. |