promptfoo/Promptfoo Code Scan
Scan pull requests for LLM security vulnerabilities
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| api-host | Promptfoo API host url | no | https://api.promptfoo.app |
| min-severity | Minimum severity level to report (low|medium|high|critical). Defaults to medium when neither min-severity nor minimum-severity is set. | no | — |
| minimum-severity | Alias for min-severity (low|medium|high|critical). Has no default; takes effect only when min-severity is not set. | no | — |
| config-path | Path to YAML configuration file | no | — |
| guidance | Custom guidance for the security scan | no | — |
| guidance-file | Path to file containing custom guidance | no | — |
| github-token | GitHub token for authentication (default: github.token) | no | ${{ github.token }} |
| enable-fork-prs | Enable scanning PRs from forked repositories | no | false |
| sarif-output-path | Optional path to write SARIF output for upload to GitHub Code Scanning | no | — |
Outputs
| name | description |
|---|---|
| sarif-path | Path to the SARIF file when a scan completes and sarif-output-path is configured |