| mode | Run mode: 'full' (all updates), 'security' (only vulnerable packages), or 'heal' (rebuild conflicting PRs) | no | full |
| repo_id | Sonatype Guide repository id (required when mode=heal) | no | "" |
| vulnerabilities | JSON array of vulnerabilities to fix (for security mode, typically provided by Guide via workflow_dispatch) | no | "" |
| working-directory | Directory containing package.json | no | . |
| node-version | Node.js version to use (20 or 22) | no | 22 |
| create-pr | Create GitHub PRs for upgrades | no | false |
| draft-pr | Create PRs as drafts | no | false |
| enable-agent | Enable AI agent for fixing validation failures | no | true |
| max-fix-attempts | Maximum AI fix attempts per group | no | 3 |
| dry-run | Preview changes without applying them | no | false |
| group | Apply only a specific group by ID | no | "" |
| validation-commands | Commands to validate upgrades (newline-separated) | no | "" |
| npmrc-content | .npmrc file content for private registry authentication | no | "" |
| maven-settings-xml | Maven settings.xml content for private repository authentication | no | "" |
| verbose | Enable verbose output (may expose sensitive data in logs) | no | false |
| github-token | Override for the token used to push commits and open PRs. When unset, the action mints one from the Sonatype Guide OIDC broker so PRs open as sonatype-guide[bot]. | no | "" |
| git-user-name | Git user name for commits. Leave blank to match the authenticating identity (sonatype-guide[bot] when the broker is used). | no | "" |
| git-user-email | Git user email for commits. Leave blank to match the authenticating identity — e.g. <user-id>+sonatype-guide[bot]@users.noreply.github.com, which is required for GitHub to show the Verified bot badge on commits. | no | "" |
| docker-image | Fully-qualified Docker image path including registry and tag. Defaults to the public Docker Hub image sonatype/agp:latest (no authentication required). To use a private registry, override this and supply docker-username/docker-password. | no | sonatype/agp:latest |
| docker-username | Docker registry username. When provided with docker-password, the action logs into the registry extracted from docker-image before pulling. Leave unset for the public default image. | no | "" |
| docker-password | Docker registry password. When provided with docker-username, the action logs into the registry extracted from docker-image before pulling. Leave unset for the public default image. | no | "" |
| skip-docker-pull | Skip pulling the Docker image (for local testing with pre-built images) | no | false |
| mount-docker-socket | Mount the host Docker socket into the AGP container, enabling Docker commands and container-based tools (e.g., Testcontainers, Docker Compose) during setup and validation | no | false |