saagpatel/Agent Permission Diff

Detect and explain agent-facing permission changes in pull requests.

Trust Signals

name	description	required	default
base-ref	Base Git ref or SHA. Defaults to the pull request base SHA when available.	no	""
head-ref	Head Git ref or SHA. Defaults to the pull request head SHA or current SHA.	no	""
mode	Gate mode: observe, warn, or enforce.	no	observe
fail-on	Minimum severity that exits 2 in warn/enforce mode.	no	critical
policy	Optional YAML policy file containing acknowledgement entries.	no	""
json	JSON report output path. Empty disables JSON output.	no	agent-permission-diff.json
sarif	SARIF 2.1.0 output path. Empty disables SARIF output.	no	agent-permission-diff.sarif
markdown	Markdown report output path. Empty disables Markdown artifact output.	no	""
step-summary	Append the Markdown report to the GitHub Actions step summary.	no	true
comment	Create or update a sticky pull request comment with the Markdown report. Requires issues: write and may require pull-requests: write.	no	false
upload-sarif	Upload SARIF to GitHub code scanning. Requires security-events: write.	no	false
working-directory	Repository working directory to scan.	no	.

name	description
json-file	Path to the JSON report.
sarif-file	Path to the SARIF report.
markdown-file	Path to the Markdown report.
exit-code	agent-permission-diff exit code.
max-severity	Maximum finding severity from the JSON report.
findings-count	Number of findings from the JSON report.
gate-status	Gate decision status: observe, pass, warn, or fail.
gate-threshold-met	Whether the maximum finding severity met the fail-on threshold.