tanzercakir-commits/CodeSkeptic Analyze
Precision-first C/C++ static analysis with dataflow traces. Downloads a CodeSkeptic release binary, analyzes your code, and can upload SARIF to GitHub code scanning. Default gate is report-only: findings are reported but do not fail the job until you opt in.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Directory or file to analyze | no | . |
| build-path | Directory containing compile_commands.json (strongly recommended) | no | "" |
| sarif | SARIF output file path | no | codeskeptic.sarif |
| upload-sarif | Upload the SARIF to GitHub code scanning (needs security-events: write) | no | true |
| gate | report-only (default): always exit 0, findings inform. error: exit 1 when findings are reported — opt in AFTER a report-only adoption week (see docs/evaluate.md). | no | report-only |
| version | Release tag to use (e.g. v0.4.0); latest release by default | no | latest |
| extra-args | Extra CLI arguments (e.g. --alloc-functions my_malloc --report-paths $PWD/src) | no | "" |
Outputs
| name | description |
|---|---|
| exit-code | Raw analyzer exit code (0 clean, 1 findings) |