shivasurya/Code-Pathfinder
Security scanning with Code Pathfinder - open source, type-aware SAST with cross-file dataflow analysis
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| rules | Path to Python SDK rules file or directory | no | — |
| ruleset | Remote ruleset(s) to use (e.g., python/flask, docker/security). Can specify multiple comma-separated. | no | — |
| project | Path to source code to scan | no | . |
| output | Output format: sarif, json, or csv | no | sarif |
| output-file | Output file path (e.g., results.sarif) | no | pathfinder-results.sarif |
| fail-on | Fail with exit code 1 if findings match severities (e.g., critical,high) | no | "" |
| verbose | Enable verbose output | no | false |
| python-version | Python version to use | no | 3.12 |
| skip-tests | Skip scanning test files | no | true |
| refresh-rules | Force refresh of cached rulesets (bypasses cache) | no | false |
| debug | Enable debug diagnostics with timestamps | no | false |
| disable-metrics | Disable anonymous usage metrics collection | no | false |
| pr-comment | Post a summary comment on the pull request with scan results | no | false |
| pr-inline | Post inline review comments for critical/high severity findings | no | false |
| github-token | GitHub token for posting PR comments (required when pr-comment or pr-inline is enabled) | no | "" |
| no-diff | Disable diff-aware scanning (scan all files instead of only changed files) | no | false |
Outputs
| name | description |
|---|---|
| results-file | Path to the output results file |
| version | Installed pathfinder version |