subhashmahimaluri/PR Review Insight — PR quality, security & a11y gate
Scan the PR for dead code, duplication, complexity, security, OWASP, a11y, pentest hygiene and Sonar-style smells. One premium PR comment — graphs on top, details collapsed — and a merge gate on what the PR introduced.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub token (use secrets.GITHUB_TOKEN) | yes | — |
| mode | `report` (PR scan + comment) or `baseline` (record default-branch baseline) | no | report |
| baseline-branch | Orphan branch holding baselines, history and band SVGs | no | pr-review-insight-baseline |
| baseline-mode | How to resolve the baseline: `auto` (recorded branch, falling back to scanning the merge-base in this run), `branch`, `scan` (dual-scan — no baseline branch needed, requires checkout fetch-depth: 0), or `off` | no | auto |
| gates | JSON overriding the config file `gates` key, e.g. {"newFindings":{"critical":0,"major":5},"duplication":{"maxPercent":5}} | no | — |
| ignore | Extra ignore globs (comma or newline separated) | no | — |
| strict | A scanner crash fails the job (default: degrade to a warning) | no | false |
| comment | Post/update the PR comment | no | true |
| check-run | Post a check run with inline annotations | no | true |
| annotations | Inline annotations on touched lines: `new`, `all` or `none` | no | new |
| report-file | Path for the versioned JSON report artifact | no | code-report.json |
| sarif-file | Also emit SARIF here (upload with github/codeql-action/upload-sarif) | no | — |
| html-file | Self-contained interactive HTML report (print → PDF ready) | no | code-report.html |
| fix-plan-file | Markdown fix plan — new findings first with one ready-to-paste AI prompt each (Copilot Chat etc.), pre-existing debt as per-category batches | no | fix-plan.md |
| upload-artifact | Upload report + HTML + fix plan as a run artifact and link it from the PR comment (📥 download the full report) | no | true |
Outputs
| name | description |
|---|---|
| state | Report state (passed | gate-failed | new-findings | improved | no-change | no-baseline | invalid-data | scan-error) |
| verdict | Gate verdict (pass | warn | fail) |
| total-findings | Total findings in the scan |
| new-findings | Findings introduced by this PR |
| report-file | Path of the JSON report artifact |