| license-key | PullGuard license key — unlocks Pro (43 of 45 analyzers; 1 repo), Team (all 45 incl. custom-rules + SOC 2; 10 repos), or Enterprise (all 45; unlimited repos + SSO + SLA — contact sales). Free tier (14 analyzers: core + dangerous-files + repo-hygiene) works without a key. | no | "" |
| fail-on-severity | Fail the workflow if findings at this severity or above exist. Options: info, minor, moderate, major, critical. Default: empty (never fail). | no | "" |
| hourly-rate | Developer hourly rate (USD) for cost estimation. Default: 150 USD. | no | 150 |
| config | Path to .driftrc.yml configuration file (relative to repo root). | no | "" |
| path | Path to scan (relative to repo root). Default: entire repo. | no | . |
| report-to-app | When true, POST the scan report to the PullGuard GitHub App backend (/api/app/report) so findings appear as native Check Run annotations on the PR Files-changed view. Requires the PullGuard App to be installed on the repo. Default: false (backwards-compatible; Step Summary + PR comment still render). | no | false |
| delta | Force "Clean as You Code" delta filtering — surface only findings introduced relative to base-ref (plus security criticals) — on NON-PR events too (push, schedule, workflow_dispatch). On pull_request this is already automatic. Use with base-ref to diff against a chosen ref. Default: false (full inventory off-PR). | no | false |
| base-ref | Git ref to diff against when delta filtering off-PR (e.g. a release tag like v1.2.0, or origin/main). Ignored on pull_request events (the PR target branch is used automatically). Requires a deep enough checkout (actions/checkout fetch-depth: 0) for the ref to be present. | no | "" |
| image-pin | Which scanner image the action runs. Default `1` — the moving major-line tag that always resolves to the newest stable v1.x.y RELEASE (re-pointed only when a signed release is cut, never per-merge), so scans stay current with security improvements yet reproducible. Set `latest` for the bleeding-edge image rebuilt on every merge to main. Pin an exact release tag (`v1.0.0`) or a `sha256:<hex>` digest to freeze one version for change-controlled / air-gapped environments. SHA tags (e.g. `4fdfc1a`) are retained 7 days; release tags `v[0-9]+.[0-9]+.[0-9]+` are preserved forever and the `1` / `1.0` lines re-point to them (ADR-0054 Phase A / ADR-0066). Examples: `image-pin: 1`, `image-pin: latest`, `image-pin: v1.0.0`, `image-pin: sha256:4ab06b5dde376477c9747406da72f6bb80ff471490a5af200d7ff3943f26355e`. | no | 1 |
| collapse-preexisting-security | When true, in delta mode the PR comment collapses PRE-EXISTING security findings (already in your committed baseline) into a separate counted section, so the inline list shows what THIS PR introduced. New security findings still surface inline, and every security finding remains in the full report, SARIF, and the fail-on-severity gate (nothing is hidden). Requires a tier-matched baseline. Default: false. | no | false |
| server-url | Optional: base URL of your self-hosted PullGuard server (ADR-0087), e.g. https://pullguard.yourcompany.com. When set (with server-token), the scan RESULTS (not source) are POSTed to <url>/api/scans after the scan so they appear on your central dashboard. Best-effort — a failed upload never fails the scan. | no | "" |
| server-token | Ingest bearer token for your self-hosted PullGuard server (pair with server-url). Store as a secret. | no | "" |
| update-baseline | When true, write/refresh .drift-baseline.json from this scan and commit it. Run this on a PUSH to your base branch (e.g. develop/main) — a full scan at your license tier — so the committed baseline matches what PR-delta scans subtract against. Ignored on pull_request events. Your workflow must commit the updated file (see docs). This removes the separate keyed baseline-generation step. Default: false. | no | false |
| blame | When true, annotate each finding with its git-blame "introduced" date, commit, and author, so the HTML report + dashboard artifacts show finding age and owner. Requires a deep checkout (actions/checkout fetch-depth: 0) for the history to be present; best-effort otherwise (findings just stay undated). Off by default — blame-per-finding adds scan latency. Default: false. | no | false |
| gate | When true, enforce the Quality Gate your organisation administers on its self-hosted PullGuard server: the scan uploads results, the server evaluates the gate assigned to this repo, and this step exits non-zero when the gate does not pass — mark the check required in your branch-protection rules to make it a merge gate. Requires server-url + server-token. Fails CLOSED: if no verdict can be obtained (server unreachable / bad token), the step fails rather than silently passing. Independent of fail-on-severity, which always remains a floor a gate cannot weaken. Default: false. | no | false |