sroscuroblck/ConstraintGuard

Constraint-aware security prioritization for embedded C/C++ projects

Trust Signals

name	description	required	default
mode	Operation mode: 'score' (parse existing SARIF) or 'run' (execute scan-build + score)	no	score
sarif-path	Path(s) to SARIF file(s), space-separated. Required when mode=score.	no	""
config-path	Path to .constraintguard.yml	yes	—
linker-script	Path to linker script (.ld) for memory constraint extraction	no	""
source-path	Path to source directory. Required when mode=run.	no	.
build-cmd	Build command (e.g. 'make'). Required when mode=run.	no	""
fail-on	Fail the step if any finding reaches this tier or above (critical, high, medium, low). Leave empty to never fail.	no	""
top-k	Number of top findings to show in the PR comment (default: 5)	no	5
comment-on-pr	Post a summary comment on the PR (true/false)	no	true
python-version	Python version to use	no	3.12
analysis-mode	Analysis mode: 'expert' (default), 'llm', or 'hybrid'	no	expert
llm-topk	Number of top findings to analyze with LLM (default: 10)	no	10
llm-changed-files	Limit LLM analysis to files changed in PR (true/false)	no	false
llm-provider	LLM provider: 'openai' or 'anthropic'. Required when analysis-mode is 'llm' or 'hybrid'.	no	""
llm-model	LLM model name (e.g. 'gpt-4o-mini', 'claude-sonnet-4-20250514'). Required when analysis-mode is 'llm' or 'hybrid'.	no	""
llm-api-key	API key for the chosen LLM provider. Required when analysis-mode is 'llm' or 'hybrid'.	no	""
llm-max-retries	Max retries for failed LLM requests (default: 1)	no	1
llm-effort	Reasoning effort for supported models: 'low', 'medium', or 'high' (default: low)	no	low

name	description
report-json	Path to the generated JSON report
report-md	Path to the generated Markdown report
exit-code	Exit code from constraintguard (0=pass, 2=threshold exceeded)
total-findings	Total number of findings
critical-count	Number of CRITICAL findings
high-count	Number of HIGH findings