| base | Base ref for git diff | no | origin/${{ github.base_ref }} |
| head | Head ref for git diff | no | HEAD |
| output | JSON artifact path | no | .pi/security-review/ci-context.json |
| markdown | Markdown report artifact path | no | .pi/security-review/ci-report.md |
| model | Requested Pi model metadata to record; does not configure provider auth | no | "" |
| final-report | Model-produced report containing pi-security-review JSON marker | no | "" |
| scan-instructions-file | Repo-relative custom security scan instructions file | no | "" |
| filter-instructions-file | Repo-relative custom false-positive filtering instructions file | no | "" |
| scan-instructions-text | Inline custom security scan instructions | no | "" |
| filter-instructions-text | Inline custom false-positive filtering instructions | no | "" |
| include | Comma-separated include globs overriding repo config include | no | "" |
| exclude | Comma-separated exclude globs appended to repo config exclude | no | "" |
| paths | Comma-separated focus paths for git diff | no | "" |
| exclude-directories | Comma-separated directories to exclude; upstream-compatible alias | no | "" |
| upload-results | Upload JSON and Markdown results as workflow artifact | no | true |
| retention-days | Artifact retention days for uploaded results | no | 7 |
| comment | Post PR comment. Requires yes=true and final-report unless allow-artifact-comment=true | no | false |
| pr | Pull request number for optional comment | no | "" |
| yes | Explicit approval for GitHub comment mutation | no | false |
| allow-artifact-comment | Maintainer override to comment artifact-only context; not recommended for security results | no | false |
| fail-on-high | Fail when final report contains HIGH findings | no | false |
| fail-on-medium | Fail when final report contains MEDIUM or HIGH findings | no | false |