startmatter/Cerberus security scan

Run Semgrep, Gitleaks and Trivy, report findings to your tracker and gate the merge on new ones.

Trust Signals

name	description	required	default
url	Ingest URL from the tracker's integration settings. Not needed when mode is `off`.	no	""
secret	Ingest secret (store it as a repository or organization secret). Not needed when mode is `off`.	no	""
path	Directory to scan.	no	.
mode	auto \| report \| check \| off. Default auto — report on the default branch, check elsewhere.	no	auto
image	Cerberus image to run.	no	ghcr.io/startmatter/cerberus:latest
dns	DNS servers for the scan container, comma-separated. Needed on self-hosted runners whose resolver the container cannot reach — without it Semgrep cannot fetch its rules and Trivy cannot fetch its vulnerability database, and both quietly produce nothing. Empty uses the host's resolver.	no	""
registry-token	Token used to pull the image when it is private (the default GITHUB_TOKEN works for images in the same organization; needs the `packages: read` permission on the job). Leave empty for a public image.	no	${{ github.token }}

no outputs