prasadnadkarni/MobileGate
Android APK security release gate. Runs MobileGate against a built APK, fails the workflow on BLOCKED, and posts/updates a PR comment with the result.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| apk-path | Path to the APK to scan. This is almost always a build artifact produced earlier in the same job (e.g. Gradle's app/build/outputs/apk/release/app-release.apk) — MobileGate does not build your app, and this action does not assume the APK is committed to the repo. | yes | — |
| config-path | Path to .mobilegate.yml. Unset: MobileGate uses its own default (.mobilegate.yml in the working directory); a missing file there is not an error. | no | "" |
| baseline-path | Path to a baseline file, enabling baseline mode for this run (findings already present in the baseline don't block). Unset: mode comes from .mobilegate.yml's policy.mode (defaulting to strict if that's also unset) — see the README's baseline mode section. | no | "" |
| version | MobileGate release version to fetch, e.g. "v0.4.0". Default "latest" resolves to the newest GitHub release at github.com/prasadnadkarni/mobilegate/releases. Pin an exact version for a reproducible pipeline. | no | latest |
| comment-on-pr | Post (or update) a PR comment with the Markdown report. Ignored (no-op, not an error) on any event that isn't a pull request. | no | true |
| comment-marker | Distinguishes this action's PR comment from others so re-runs update the same comment instead of stacking new ones. Only worth changing if a single workflow scans multiple APKs and needs a separate comment per APK. | no | default |
| fail-on-comment-error | Fail the action if comment-on-pr is true but posting/updating the comment fails (including a missing pull-requests: write permission) — spec: fail loudly, not silently. Set to "false" to let a comment-posting failure be non-fatal while the scan result itself still governs the action's exit code. | no | true |
| github-token | Token used to (a) fetch the pinned MobileGate release (any valid token clears GitHub's unauthenticated rate limit; the release is public) and (b) post/update the PR comment, which specifically needs pull-requests: write on the CALLING workflow's token — see the README's permissions section. Defaults to the workflow's own automatic token. | no | ${{ github.token }} |
| sarif-file | Path to write a SARIF 2.1.0 file and upload it to GitHub Code Scanning (via github/codeql-action/upload-sarif@v4 — this action handles the upload itself, the calling workflow does not need its own upload step). Unset (default): no SARIF file is produced and no upload happens. Requires the calling workflow/job to grant security-events: write — if that's missing, the upload step fails loudly with GitHub's own permission error, it does not fail silently. See the README's SARIF section for what does and doesn't map to a real source location in the Security tab, and why. | no | "" |
Outputs
| name | description |
|---|---|
| gate-decision | "pass" or "blocked" — mirrors the JSON contract's gate_decision field. |
| score | The secondary 0-100 score (see README: never contradicts gate-decision). |