| ai-api-key | API key for the AI provider — Anthropic or OpenAI key. Not required when ai-provider is github; use github-token instead. | no | "" |
| ai-provider | AI provider: anthropic | openai | github (GitHub Models — free, no external account needed) | no | anthropic |
| ai-model | Model to use. Anthropic: claude-sonnet-4-6. OpenAI: gpt-4o. GitHub Models: gpt-4o-mini | no | claude-sonnet-4-6 |
| github-token | GitHub token for SARIF upload, PR comments, and GitHub Models AI (ai-provider: github). Always pass secrets.GITHUB_TOKEN. | no | "" |
| license-key | Signed SSDL1 license token for Pro/Enterprise features (optional — free tier if omitted) | no | "" |
| enable-sast | Run SAST scanning with Semgrep | no | true |
| enable-secret-scan | Run secret scanning with Gitleaks | no | true |
| enable-sca | Run Software Composition Analysis (dependency vulnerabilities) | no | true |
| enable-iac-scan | Run IaC security scan with Checkov (Terraform, CloudFormation, Bicep) | no | true |
| enable-container-scan | Run container image scan with Trivy | no | false |
| container-image | Container image to scan (required if enable-container-scan is true) | no | "" |
| trivy-ignore-unfixed | For the container image scan path (trivy image) only: skip CVEs that have no fix available in the OS package manager to reduce noise from won't-fix entries in base images. Does not affect Trivy filesystem/SCA scans (trivy fs). | no | false |
| enable-threat-modeling | Run AI-powered STRIDE threat modeling on architecture changes | no | false |
| enable-ai-triage | Use AI to triage, deduplicate and prioritise findings | no | true |
| enable-ai-fix-suggestions | Include AI-generated fix suggestions in the PR comment | no | true |
| severity-threshold | Minimum severity that fails the build: critical | high | medium | low | no | high |
| fail-on-findings | Set to false to report findings without blocking the workflow | no | true |
| post-pr-comment | Post AI security summary as a PR comment | no | true |
| sarif-upload | Upload SARIF results to GitHub Security tab | no | true |
| cloud-provider | Primary cloud target for WAF control mapping: aws | azure | gcp | no | aws |
| ssdlc-api-url | Platform API base URL for DORA event reporting (e.g. https://api.ssdlc.io) | no | "" |
| ssdlc-api-key | API key for authenticating with the SSDLC platform API | no | "" |
| ssdlc-user-id | User ID (UUID) to associate DORA events with the correct account | no | "" |
| environment | Deployment environment name for DORA tracking (e.g. dev, staging, production) | no | production |
| semgrep-rules | Custom Semgrep ruleset (e.g. p/owasp-top-ten). Defaults to auto. | no | auto |
| checkov-framework | Checkov framework filter (e.g. terraform,cloudformation). Defaults to all. | no | "" |
| output-dir | Directory to write scan artefacts and reports into | no | .ssdlc-results |