r12habh/ActionScope
Map the AWS blast radius of GitHub Actions workflows and AI agent configs
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to the repository root to scan | no | . |
| fail-on | Fail the action if overall risk is at or above this level (critical, high, medium, low) | no | high |
| output-format | Output format: terminal, json, markdown, or sarif | no | terminal |
| upload-sarif | Upload SARIF results to GitHub Code Scanning | no | false |
| resolve-pins | Resolve unpinned action tags to current SHA via GitHub API | no | false |
| offline | Disable scan-time GitHub and AWS API calls | no | false |
| save-state | Save scan state for delta comparison in future scans | no | false |
| load-state | Compare against previous scan state for delta reporting | no | false |
| state-artifact-name | GitHub Actions artifact name for persisting scan state | no | actionscope-state |
| comment-pr | Post findings as a PR comment (requires pull-requests: write permission) | no | false |
| github-token | GitHub token for PR comments, pin resolution, and external reusable workflow inspection | no | ${{ github.token }} |
| version | ActionScope version to install (default: latest) | no | "" |
Outputs
| name | description |
|---|---|
| overall-risk | The overall risk level found (critical, high, medium, low, info) |
| findings-json | JSON string of all findings |
| credential-sources-count | Number of AWS credential sources found |