salhakim/Stripe Billing Audit

Read-only lint for your Stripe billing configuration — reports revenue-losing misconfigurations as severity-ranked findings.

Trust Signals

name	description	required	default
api-key	Restricted, read-only Stripe API key. Pass from an encrypted Actions secret (e.g. ${{ secrets.STRIPE_AUDIT_KEY }}); it is routed to the CLI via the STRIPE_SECRET_KEY env and never appears on the command line.	yes	—
output	Report format for the human-facing render (job summary / PR comment): console \| json \| markdown. The gate/outputs step always parses JSON internally.	no	markdown
fail-on	Exit non-zero when an active finding is at/above this severity: critical \| high \| medium \| low \| none.	no	high
baseline	Path to a committed baseline file. When set, the audit gates on NEW findings vs the baseline and this REPLACES the --fail-on severity gate (see README § precedence). Leave empty to gate on absolute severity via fail-on.	no	""
deep	Enable deep audit mode (set to "true"). Accepted as a no-op on CLI versions before it lands.	no	false
working-directory	Directory to run the audit from (resolves .stripeauditignore / config / baseline relative paths).	no	.
version	Published stripe-audit version/tag to run via npx (e.g. "latest" or a pinned major like "0"). Pin for reproducible CI.	no	latest

name	description
score	Numeric audit score (0–100) parsed from the JSON summary.
grade	Letter grade (A–F) parsed from the JSON summary.