rohanbatrain/AutoTriage security triage

Scan a repository with Semgrep/Trivy/Gitleaks, triage every finding with an autonomous Claude agent, and post the verdicts as a pull-request comment.

Trust Signals

name	description	required	default
scan-path	Directory to scan.	no	.
anthropic-api-key	Anthropic API key for live LLM triage. When empty (e.g. a fork PR that cannot read secrets), AutoTriage falls back to the deterministic offline stub backend so the run still produces a triage summary.	no	""
model	Model id for the triage agent (defaults to the tool default).	no	""
max-findings	Cost guardrail: triage at most this many findings (most severe first).	no	80
codeowners	Path to a CODEOWNERS file used to assign an owner to each finding.	no	""
comment	Post/update a pull-request comment with the triage summary.	no	true
github-token	Token used to post the PR comment (needs pull-requests: write).	no	${{ github.token }}
python-version	Python version to run the agent on.	no	3.12

no outputs