santhreal/KeyHog Secret Scanner
Scan source code for leaked secrets with KeyHog.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (file or directory). | — | . |
| severity | Minimum severity to report: info | client-safe | low | medium | high | critical. | — | high |
| format | Output format supported by the composite Action: text | json | sarif | jsonl. | — | sarif |
| verify | Run live credential verification on findings ("true" enables --verify). | — | false |
| version | KeyHog version to use. Matched against a published GitHub Release tag. Exact versions use vMAJOR.MINOR.PATCH with an optional prerelease suffix; build metadata is not published and is rejected. Exact versions, semver action tags, and floating major tags require the complete signed binary and GPU literal bundle. When unset, exact and floating release refs resolve the checked-out release version. Branch and commit refs build their checked-out source directly. | — | "" |
| upload-sarif | When format=sarif, upload via the GitHub Code Scanning SARIF action. | — | true |
| analysis-category | Stable lowercase identity for this analysis partition. Use a distinct value for each monorepo slice or matrix partition scanned on one commit. Allowed: 1-64 lowercase letters, digits, dot, underscore, or dash. Start and end with a letter or digit. | — | keyhog |
| fail-on-findings | Fail the workflow when any finding at or above `severity` is reported. Set to "false" to keep the job green and rely on the uploaded SARIF surfacing in code-scanning instead. Verified-live credentials under `verify: "true"` always fail after reports are uploaded. | — | true |
| baseline | Path to a keyhog baseline file (produced by `keyhog scan --create-baseline baseline.json` and committed to the repo). Findings already present in the baseline are suppressed, so the job blocks only NEW secrets. This is the standard way to adopt keyhog in a repo that already has findings, without a noisy failing first run. | — | "" |
| backend | Optional scan backend: auto | simd | cpu | gpu-cuda | gpu-wgpu. Leave unset or choose auto to calibrate this workload; explicit backends are for diagnostics. | — | "" |
Outputs
| name | description |
|---|---|
| findings | Number of findings at or above `severity` (parsed from the report). |
| exit-code | Raw keyhog process exit code: 0 clean, 1 findings, 10 live findings under --verify. |
| duration-ms | Wall-clock scan duration in milliseconds, measured by the Action wrapper. |
| scan-status | Typed terminal scan state: success, partial, cancelled, or failed. |
| report-present | Whether the scanner wrote the requested report before termination. |
| report | Path to the produced scan report (relative to the workspace). |
| analysis-category | Validated Code Scanning and report partition identity. |