| ai-provider | AI provider: "azure" for Azure OpenAI or "github-models" for GitHub Models | no | github-models |
| azure-openai-api-key | Azure OpenAI API key | no | — |
| azure-openai-endpoint | Azure OpenAI endpoint URL | no | — |
| azure-openai-api-version | Azure OpenAI API version | no | 2024-02-01 |
| azure-openai-deployment | Azure OpenAI deployment name | no | gpt-4 |
| github-models-token | GitHub token for GitHub Models API (can use GITHUB_TOKEN) | no | — |
| github-models-model | GitHub Models model name | no | gpt-5 |
| terraform-plan-path | Path to the Terraform plan JSON file | no | tfplan.json |
| terraform-directory | Directory containing Terraform files | no | . |
| github-token | GitHub token for commenting on PRs | yes | — |
| disable-pr-comment | Disable automatic PR commenting (useful when multiple workflows use the same action) | no | false |
| analysis-preset | Analysis preset: "security-audit", "cost-optimisation", "production-ready", "quick-check", or "complete". Overrides analysis-focus if set. | no | complete |
| analysis-focus | Focus areas for analysis (comma-separated): security,cost,best-practices,deployment,compliance,performance,reliability,observability,networking,data,governance | no | security,cost,best-practices,deployment |
| analysis-mode | Analysis mode: "plan-only" for faster analysis of just the JSON plan, or "comprehensive" for plan + source files | no | comprehensive |
| analysis-depth | Analysis depth: "quick" for high-level review, "standard" for balanced analysis, or "detailed" for comprehensive examination | no | detailed |
| analysis-style | Analysis organisation: "severity" for summary with critical/warnings/recommendations, or "domain" for grouping by focus areas | no | severity |
| skip-mcp-validation | Skip HashiCorp Terraform MCP server validation | no | false |
| show-mcp-details | Show detailed MCP server analysis section for troubleshooting | no | false |
| mcp-server-timeout | Timeout in seconds for MCP server startup | no | 60 |
| enable-data-scrubbing | Enable automatic scrubbing of sensitive data (passwords, API keys, secrets) before sending to AI | no | true |
| max-file-size-mb | Maximum size per file in MB (prevents processing oversized files) | no | 10 |
| max-total-size-mb | Maximum total size of all files in MB (prevents excessive API costs and memory usage) | no | 50 |
| max-files | Maximum number of files to process (prevents resource exhaustion) | no | 100 |
| api-timeout-seconds | Timeout for AI API calls in seconds (prevents hanging requests) | no | 120 |
| api-max-retries | Maximum number of API retry attempts with exponential backoff | no | 3 |