| source-directory | Path to the source code directory to scan | no | . |
| output-directory | Directory where scan results will be saved | no | ash_output |
| output-format | Output format for scan results (text, json, or both) | no | text |
| fail-on-findings | Whether to fail the action when security findings are detected | no | true |
| severity-threshold | Minimum severity level to report (low, medium, high, critical) | no | medium |
| offline-mode | Run in offline mode using pre-downloaded vulnerability databases | no | false |
| file-extensions | Comma-separated list of file extensions to scan (e.g., py,js,tf) | no | "" |
| exclude-patterns | Comma-separated list of file patterns to exclude from scanning | no | "" |
| preserve-reports | Add timestamp to report names to avoid overwriting previous results | no | false |
| parallel-execution | Enable parallel execution of security scanners for faster results | no | true |
| debug | Enable debug logging for troubleshooting | no | false |
| quiet | Suppress verbose output during scanning | no | false |
| sarif-output | Generate SARIF output for GitHub Security tab integration | no | true |
| upload-sarif | Automatically upload SARIF results to GitHub Security tab using official CodeQL action | no | true |
| sarif-category | Category for SARIF upload to distinguish multiple scans | no | automated-security-helper |
| github-token | GitHub token for PR comments and artifact upload (defaults to github.token) | no | "" |
| wait-for-processing | Wait for SARIF processing to complete before finishing | no | true |
| pr-comment | Add inline comments to pull requests for security findings | no | true |
| pr-comment-mode | PR comment mode: review (batched) or individual (immediate) | no | review |
| pr-comment-format | PR comment format: sarif (enhanced) or legacy (simple) | no | sarif |
| ash-version | Specific version of ASH to use (defaults to beta for v3 features) | no | beta |
| ash-mode | ASH execution mode: local, container, or precommit (v3 feature) | no | local |
| custom-config | Path to custom ASH configuration file | no | "" |
| upload-artifacts | Upload scan results as GitHub Actions artifacts | no | true |
| artifact-retention-days | Number of days to retain uploaded artifacts | no | 30 |
| enable-caching | Enable Docker layer and basic directory caching for faster subsequent runs | no | true |
| cache-ttl | Cache refresh frequency: daily, weekly, monthly | no | weekly |
| scanners | Comma-separated list of specific scanners to run (defaults to all enabled scanners) | no | "" |
| exclude-scanners | Comma-separated list of scanners to exclude from execution | no | "" |
| ignore-suppressions | Ignore all suppression rules and report all findings regardless of suppression status | no | false |
| offline-semgrep-rulesets | Specify Semgrep rulesets for use in ASH offline mode (e.g., p/ci, p/security-audit) | no | p/ci |