shurtug4l/sec-recon SBOM gate

Deterministic, LLM-free SBOM vulnerability gate: OSV + KEV/EPSS/exploit, SSVC priority, SARIF + OpenVEX, CI exit code.

Trust Signals

name	description	required	default
sbom-path	Path to the SBOM to scan (CycloneDX 1.x JSON, SPDX 2.x JSON, or requirements.txt), relative to the workspace.	yes	—
fail-on	Minimum SSVC decision that fails the gate: act, attend, track-star, or never.	no	act
strict	Fail the gate on enrichment coverage gaps (feed errors), not only on findings.	no	false
artifact-uri	Repo-relative path GitHub code scanning attaches alerts to. Defaults to sbom-path.	no	""
github-token	Token for the GitHub exploit-search arm of exploit_check. Optional: without it the gate still runs and marks exploit coverage as degraded (ExploitDB only) instead of silently downgrading.	no	""
upload-sarif	Upload the SARIF to GitHub code scanning.	no	true
sarif-category	Code scanning category for the SARIF upload.	no	sec-recon-gate
python-version	Python version used to run the gate.	no	3.13

name	description
verdict	pass or fail (the policy verdict; infra failures fail the step directly).
exit-code	Raw gate exit code: 0 pass, 1 policy fail, 2 infrastructure failure.
report-path	Path to the full GateReport JSON.
sarif-path	Path to the SARIF 2.1.0 document.
openvex-path	Path to the OpenVEX document, empty when no finding carried a product identity (the gate excludes rather than fabricates).