pythonwoods/Zenzic Documentation Quality Gate

Deterministic Document Integrity Engine and SAST for Markdown/MDX graphs.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 11, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: pythonwoods/zenzic-action@c8838a564c325d3918254233d18cdca505e774a2 # v2.7.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
working-directory	Relative path to the directory where Zenzic should run (useful for monorepos)	no	.
version	Zenzic version to use. Defaults to latest stable.	no	0.23.1
format	Output format: 'text', 'json', or 'sarif'.	no	sarif
sarif-file	Relative path for the SARIF output file (used when format is 'sarif'). Must be a relative path inside the workspace — absolute paths and path traversal sequences ('..') are rejected by the wrapper.	no	zenzic-results.sarif
upload-sarif	Upload SARIF results to GitHub Code Scanning (requires format: sarif).	no	true
strict	Exit non-zero on warnings as well as errors.	no	false
fail-on-error	Fail the workflow step if Zenzic finds errors.	no	true
config-file	Optional path to a Zenzic configuration file inside the workspace. If not provided, the action automatically searches for '.zenzic.toml' in the repository root, then '.github/.zenzic.toml' (root-first auto-discovery). Absolute paths and path traversal sequences ('..') are rejected.	no	""
audit	Run in sovereign audit mode: all inline zenzic:ignore comments and per_file_ignores entries are bypassed. Reveals the true (unfiltered) state of the documentation. Recommended for nightly builds and security review workflows.	no	false
diff-base	Path to a JSON report file to use as the baseline for 'zenzic diff' comparison instead of the saved .zenzic-score.json snapshot. Use an artifact from the main branch to block PRs that increase technical debt.	no	""
guard-scan	Run 'zenzic guard scan' as a Defense-in-Depth step before the main quality gate. Detects hardcoded credentials and forbidden patterns committed without pre-commit hooks. Failure is always fatal — not governed by fail-on-error.	no	false
check-stamp	Run 'zenzic score --check-stamp' after the main audit. Fails the build if any badge_stamp_files contain a stale score. Set to 'false' to opt out.	no	true

Outputs

name	description
sarif-file	Path to the generated SARIF file.
findings-count	Total number of findings reported.
score	Documentation Quality Score (0-100). Empty when format is not json or sarif.
suppression-debt-pts	Technical Debt points deducted from the score due to active suppressions. 0 when no suppressions are active.
cap-exceeded	'true' when the suppression CAP was exceeded and blocked the build; 'false' otherwise.