| api_key | RSOLV API key for authentication (deprecated, use rsolvApiKey) | no | — |
| rsolvApiKey | RSOLV API key for authentication (get yours at rsolv.dev/signup) | yes | — |
| config_path | Path to RSOLV configuration file | no | .github/rsolv.yml |
| issue_label | Label to identify issues for automation | no | rsolv:detected |
| environment_variables | JSON string of environment variables to pass to the container | no | — |
| api_url | RSOLV API URL (defaults to production) | no | https://api.rsolv.dev |
| github-token | GitHub token for PR/issue operations. Automatically provided by GitHub Actions.
Only override if you need custom permissions.
| no | ${{ github.token }} |
| mode | Operation mode - choose based on your workflow:
- 'scan': Scan repository for vulnerabilities, create GitHub issues, register a PipelineRun (recommended starting point)
- 'process': Process pending work for an existing PipelineRun (use in a separate job after scan, pass pipeline_run_id)
- 'full': Run all phases in a single job — scan, validate, and mitigate (simplest setup, uses more credits at once)
- 'validate': Validate a single issue via backend orchestration (advanced, requires issue_number)
- 'mitigate': Mitigate a single validated issue via backend orchestration (advanced, requires issue_number)
Recommended patterns:
- Single-job: mode=full (easiest, good for small repos)
- Multi-job: Job 1: mode=scan → Job 2: mode=process with pipeline_run_id from Job 1
| no | scan |
| scan_mode | Scan mode operation: fix (default) or scan | no | fix |
| enable_security_analysis | Enable security vulnerability analysis | no | true |
| scan_output | Where scan findings go (comma-separated). Options: issues, report, dashboard.
- 'issues': Create GitHub issues (default, triggers validate/mitigate pipeline)
- 'report': Upload structured JSON+markdown report as workflow artifact
- 'dashboard': Send findings to RSOLV platform dashboard (future)
Use 'report' alone for audit/discovery scans without issue creation.
| no | issues |
| max_issues | Maximum number of issues to process in a single run | no | 3 |
| max_validations | Maximum validations to process per run. Capped by your remaining budget. | no | — |
| issue_number | Specific issue number to process (for workflow_dispatch) | no | "" |
| use_git_based_editing | Enable git-based in-place editing for true file modifications (ADR-012) | no | true |
| enable_enhanced_context | Enable enhanced context gathering (uses more tokens but may improve accuracy) | no | true |
| enable_ast_validation | Enable AST-based validation to reduce false positives (recommended) | no | true |
| use_structured_phases | Enable structured phased prompting to ensure files are edited before JSON generation | no | true |
| enable_educational_pr | Enable educational PR descriptions with security explanations | no | true |
| executable_tests | RFC-060: Enable executable test generation in VALIDATE phase | no | true |
| create_pr | Create Pull Request after successful mitigation (default: true for production) | no | true |
| pipeline_run_id | RFC-126: Pipeline run ID from a prior scan step (required for mode=process) | no | "" |