skarn-security/Skarn AI-session scan

Scan what your CI's AI agent did: leaked credentials and attack patterns in AI coding-assistant session logs left on the runner.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
skarn-path	Path to a pre-installed skarn binary. If set (or skarn is already on PATH), the download step is skipped.	no	""
version	Skarn version to download when no binary is on PATH (for example 0.15.0). Defaults to the latest published release.	no	latest
download-base-url	Base URL the binary is fetched from: <base>/v<version>/skarn-<arch>-<os>. Checksums always come from the canonical skarn-dist release, never this URL; if a fetch from a custom base fails, the Action falls back to the canonical GitHub URL.	no	https://github.com/skarn-security/skarn-dist/releases/download
hours	Scan window in hours; 0 means no limit. Empty uses Skarn's default (720).	no	""
cli	Restrict the scan to one assistant: claude, gemini, codex, cursor, copilot. Empty scans all.	no	""
project	Restrict the scan to sessions under this project path. Empty scans all.	no	""
severity	Report only findings at or above this severity: low, medium, high, critical. Empty uses Skarn's default (medium).	no	""
fail-on-severity	Fail the job (exit 1) if any finding is at or above this severity. Empty means report-only.	no	""
fail-on-risk	Fail the job (exit 2) if the session risk score exceeds this 0-100 threshold. Empty means report-only.	no	""
sarif-file	Path the SARIF report is written to.	no	skarn-results.sarif
soft-fail	Never fail the job on findings; still report. The scan exit code is exposed as the exit-code output.	no	false
job-summary	Write a findings summary to the GitHub job summary.	no	true
annotations	Emit per-finding workflow annotations (surfaced on the run and, for a pull_request, on the Checks tab).	no	true
license	Skarn license token, exported as SKARN_LICENSE. skarn check needs a license; the free one is issued at https://getskarn.com/free after a quick email confirmation. Pass it from a repository secret. A fork pull request cannot read secrets, so the scan is skipped there, never failed.	no	""
on-missing-license	When skarn check finds no license (exit 7) and it is not a fork or Dependabot pull request: fail the job (fail) or warn and pass (warn). Fork and Dependabot pull requests are always warned and skipped regardless of this setting.	no	fail
extra-args	Additional arguments appended to the skarn check invocation. Split on whitespace; quoted values with spaces are not preserved.	no	""

Outputs

name	description
sarif-file	Path to the written SARIF report.
exit-code	The skarn check exit code (0 clean, 1 fail-on-severity, 2 fail-on-risk, 3 canary, 5 paid feature not covered, 6 scan error, 7 no license installed).
risk-score	Session risk score (0-100) parsed from the SARIF report.
findings-count	Number of findings in the SARIF report.
skipped	true whenever check found no license and did not scan, so no SARIF was written - a fork or Dependabot pull request, or on-missing-license=warn / soft-fail (exit 0), or a hard missing-license failure (exit 7). false on any run that scanned. It reports whether a SARIF exists to upload, not whether the job passed. Guard a SARIF upload with if: always() && steps.<id>.outputs.skipped != 'true'.