| github-token | GitHub token for accessing repository and security alerts (PAT or GITHUB_TOKEN) | no | ${{ github.token }} |
| github-app-id | GitHub App ID for authentication (alternative to github-token) | no | — |
| github-app-private-key | GitHub App private key for authentication (alternative to github-token) | no | — |
| github-app-installation-id | GitHub App installation ID for authentication (alternative to github-token) | no | — |
| jira-url | Jira instance URL (e.g., https://company.atlassian.net) | yes | — |
| jira-username | Jira username or email | yes | — |
| jira-api-token | Jira API token | yes | — |
| jira-project-key | Jira project key where issues will be created | yes | — |
| jira-issue-type | Jira issue type for created issues | no | Bug |
| jira-priority | Default Jira priority for issues | no | Medium |
| jira-labels | Comma-separated list of labels to add to Jira issues | no | dependabot,security |
| jira-assignee | Jira user to assign issues to | no | — |
| critical-due-days | Days until due date for critical severity issues | no | 1 |
| high-due-days | Days until due date for high severity issues | no | 7 |
| medium-due-days | Days until due date for medium severity issues | no | 30 |
| low-due-days | Days until due date for low severity issues | no | 90 |
| severity-threshold | Minimum severity level to process (low, medium, high, critical) | no | medium |
| exclude-dismissed | Whether to exclude dismissed alerts | no | true |
| update-existing | Whether to update existing Jira issues when alerts change | no | true |
| auto-close-resolved | Automatically close Jira issues when Dependabot alerts are resolved | no | true |
| close-transition | Jira transition name to close issues (e.g., "Done", "Resolved") | no | Done |
| close-comment | Comment to add when auto-closing resolved issues | no | This issue has been automatically closed because the associated Dependabot alert was resolved. |
| dry-run | If true, only log what would be done without making changes | no | false |