subodhkc/HAIEC AI Security Scan
Deterministic AI security scanning with AST analysis, policy gates, and SARIF export. No NPM required.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| haiec-api-key | HAIEC API key for authenticated scanning (from Dashboard > API Keys) | yes | — |
| github-token | GitHub token for repository access and SARIF upload | no | ${{ github.token }} |
| policy-file | Path to custom policy JSON file | no | "" |
| fail-on-critical | Fail the action if critical findings are detected | no | true |
| fail-on-high | Fail the action if high findings are detected | no | false |
| fail-on-findings | Fail the action if any findings are detected | no | false |
| python-sidecar | Enable Python AST sidecar | no | true |
| go-sidecar | Enable Go AST sidecar | no | true |
| js-sidecar | Enable JavaScript/TypeScript AST sidecar | no | true |
| upload-sarif | Upload SARIF to GitHub Code Scanning | no | true |
| output-dir | Directory for output artifacts | no | haiec-results |
| incremental | Enable incremental scanning (PR mode) | no | auto |
| base-ref | Base ref for incremental scan (auto-detected for PRs) | no | "" |
| scan-paths | Comma-separated list of paths to scan (e.g., src/,lib/) | no | "" |
| exclude-paths | Comma-separated list of paths to exclude (e.g., test/,node_modules/) | no | "" |
| timeout-minutes | Timeout for scan in minutes | no | 10 |
| working-directory | Working directory for scan | no | . |
Outputs
| name | description |
|---|---|
| status | Policy evaluation status (PASS, WARN, FAIL) |
| exit-code | Exit code (0 = pass, 1 = fail) |
| findings-total | Total number of findings |
| findings-critical | Number of critical findings |
| findings-high | Number of high findings |
| sarif-file | Path to generated SARIF file |
| bundle-file | Path to generated evidence bundle |
| content-hash | Deterministic content hash of scan results |