| scan-path | Path to the package manifest or lock file | yes | — |
| scan-profile | Path to a custom rl-profile or a supported keyword (minimum, baseline, hardened) | no | — |
| check-deps | CSV list of dependency types to check with Spectra Assure Community. Supported options: develop, release, optional, transitive. | no | release |
| transitive-depth | How many levels deep to scan transitive dependencies. Applies only if check-deps includes transitive. | no | 1 |
| report | Path and filename for exporting the scan results as an rl-protect.json report | no | "" |
| log-file | Path to a CEF log file | no | "" |
| log-label | An explicit CEF log label for referencing within a SIEM | no | "" |
| log-level | Select the desired logging level. Supported options: pass, warn, fail. | no | fail |
| rl-server | Spectra Assure Portal to connect to (e.g. https://my.secure.software/organization) | no | "" |
| rl-org | Spectra Assure Portal organization | no | "" |
| rl-group | Spectra Assure Portal group (optional) | no | "" |
| proxy-server | An optional proxy server to use | no | "" |
| proxy-port | An optional proxy server port to use | no | "" |
| proxy-user | An optional proxy server user to use | no | "" |
| proxy-password | An optional proxy server password to use | no | "" |
| ca-path | An optional ca certificate path | no | "" |
| concise | Only report the final outcome and skip all details. Default: false | no | false |
| verbose | Increase script verbosity when running the action. Default: false | no | false |
| post-pr-comment | Post scan results as a comment on the pull request. Requires github-token. Default: false | no | false |
| github-token | GitHub token used to post the PR comment. Pass secrets.GITHUB_TOKEN. Required when post-pr-comment is true. | no | "" |
| comment-template | PR comment template. concise=status summary only, expanded=rejected+warnings, verbose=full detail with policy. Individual comment-* inputs override the template. | no | "" |
| comment-level | Minimum finding level in the PR comment: fail, warn, pass. Overrides comment-template when set. | no | "" |
| comment-assessment | Assessment display style in the PR comment: table, simplified, off. Overrides comment-template when set. | no | "" |
| comment-vulnerabilities | Show the CVE vulnerability table in the PR comment. Default: true | no | true |
| comment-license | Show the package license in the PR comment. Default: false | no | false |
| comment-policy | Show the policy violations table in the PR comment. Default: false | no | false |
| comment-overrides | Show override details on assessments and policy violations in the PR comment. Default: false | no | false |