| working-directory | Subdirectory to run codemap in (for monorepos). Defaults to the repository root. | no | . |
| package-manager | Override package-manager autodetect. Accepts npm | pnpm | yarn | yarn@berry | bun. Empty = autodetect via package-manager-detector (lockfile + packageManager field + devEngines.packageManager + install-metadata + parent-dir walk). | no | "" |
| version | Pin codemap CLI version (e.g. 1.2.3). Empty = use the project's devDependency if present, else fall back to <pm> dlx codemap@latest. | no | "" |
| state-dir | Override codemap state directory location. Empty = .codemap/ at the working-directory root (codemap default). | no | "" |
| mode | Run shape: 'audit' | 'recipe' | 'aggregate' | 'command'. Default: 'audit' on pull_request events; ignored on other events (Action no-ops). 'aggregate' is reserved for v1.x — currently rejected. | no | audit |
| recipe | Recipe id (when mode=recipe). Use --recipes-json on the CLI to list known recipes. | no | "" |
| params | Recipe params for parametrised recipes (when mode=recipe). Multiline `key=value` pairs, one per line. | no | "" |
| baseline | Saved baseline name to diff against (when mode=recipe + a baseline was previously saved with --save-baseline). | no | "" |
| audit-base | Git ref to audit against (when mode=audit). Empty (default) → falls back to `github.base_ref` on `pull_request` events; on other events the action no-ops unless an explicit `command:` is set. | no | "" |
| changed-since | Filter results to files changed since the given git ref (e.g. 'origin/main'). | no | "" |
| group-by | Bucket results by 'owner' (CODEOWNERS) | 'directory' | 'package' (workspace package). Empty = no bucketing. | no | "" |
| command | Raw CLI args to invoke codemap with (escape hatch). When set, overrides mode / recipe / params / baseline / audit-base / changed-since / group-by — those are silently ignored with a warning. | no | "" |
| format | Output format: 'sarif' | 'json' | 'annotations' | 'mermaid' | 'diff' (per-mode availability varies; audit supports text/json/sarif). Default: 'sarif' (SARIF 2.1.0 → Code Scanning). | no | sarif |
| output-path | Where to write the output file. Used as the artifact-upload source when format=sarif and upload-sarif=true. | no | codemap.sarif |
| upload-sarif | Upload the SARIF artifact to GitHub Code Scanning. Requires GitHub Advanced Security on private repos. Set 'false' if your repo can't use Code Scanning (still produces the artifact for manual download / pr-comment writer). | no | true |
| pr-comment | Post a markdown summary comment on the PR (Slice 3 — opt-in for v1.0). Set 'true' to enable. Useful when SARIF→Code-Scanning isn't available (private repos without GHAS, or repos that haven't enabled Code Scanning). | no | false |
| fail-on | Exit-code policy: 'any' | 'error' | 'warning' | 'never'. v1.0 ships only 'any' (fails when any finding) and 'never' (no exit code). 'error' / 'warning' deferred until per-recipe severity overrides ship. | no | any |
| token | GitHub token for SARIF upload + PR comment posting. Empty (default) → falls back to `github.token` automatically. Pass an explicit fine-grained PAT only if you need elevated permissions. | no | "" |