| api-key | ProdCycle compliance API key (pc_...) | yes | — |
| api-url | ProdCycle API base URL | no | https://api.prodcycle.com |
| frameworks | Comma-separated framework IDs to evaluate (soc2, hipaa, nist-csf). Defaults to workspace setting. | no | "" |
| fail-on | Comma-separated severities that fail the check (critical, high, medium, low) | no | critical,high |
| severity-threshold | Minimum severity to report (critical, high, medium, low) | no | low |
| include | Comma-separated glob patterns to include (e.g. "*.tf,*.yaml"). Defaults to all changed files. | no | "" |
| exclude | Comma-separated glob patterns to exclude (e.g. "test/**,docs/**") | no | "" |
| annotate | Create inline workflow annotations (core.error/warning/notice) for findings. Does NOT control the formal PR review event — use `review-event` for that. | no | true |
| comment | Post a summary comment on the PR | no | true |
| review-event | PR review event when findings are posted. One of: 'comment' (default — always COMMENT, never blocks merge; the action still fails the CI step on blocking findings so branch protection can enforce), 'request-changes' (always REQUEST_CHANGES — adds a red 'Changes requested' review that blocks the merge button directly), 'auto' (COMMENT on pass, REQUEST_CHANGES on fail — pre-v2.4 default), or 'none' (skip the PR review entirely). | no | comment |
| scan-mode | Scan mode: 'auto' (diff for PRs, full for pushes), 'diff' (only changed lines), 'full' (entire codebase). | no | auto |
| exclude-accepted-risk | Skip findings that have been marked as accepted risk in the ProdCycle platform. Requires product-id or sync-config-id to be set. | no | true |
| exclude-resolved | Also skip findings marked as resolved in the ProdCycle platform (opt-in). Requires product-id or sync-config-id. | no | false |
| product-id | ProdCycle product UUID this repo maps to. Enables accepted-risk/resolved suppression for the product. Either this or sync-config-id. | no | "" |
| sync-config-id | ProdCycle sync configuration UUID linking this repo to a product. Alternative to product-id for identifying the product. | no | "" |
| github-token | GitHub token for PR comments and annotations. Defaults to the automatic GITHUB_TOKEN. | no | ${{ github.token }} |
| comment-identity | Who authors PR comments. 'auto' posts as prodcycle[bot] when the ProdCycle GitHub App is installed (falling back to github-actions[bot]), 'app' requires the App identity, 'github-token' always uses github-actions[bot]. Requires pull-requests: write permission to resolve threads. | no | auto |