| config-path | Trusted base-branch config path. For pull_request safety this must remain .quorate.yml; alternate PR-controlled paths are rejected. | no | .quorate.yml |
| mode | Council mode. Only review is implemented for the GitHub Action. | no | review |
| providers | Comma-separated provider ids to enable for this run (overrides enabled: in .quorate.yml). Generate entries locally with `quorate provider add`. | no | — |
| pack | Domain pack(s) to layer onto the review: a comma-separated list (e.g. "solana,web3-dd") or "auto" to detect from the pull request's changed files. Adds pack councils + per-role reviewer guidance on top of the base config; the deterministic heuristics for a language always run regardless. | no | — |
| fail-on | Requested minimum failing severity. It may tighten the committed base policy, but never or a weaker value cannot relax that policy. | no | high |
| post-comment | Whether to post or update the Quorate PR comment. | no | true |
| github-token | GitHub token used to read PR files and write comments. | no | — |
| runner-mode | Provider runner mode: auto, cli, or api. `auto` is runner-aware — on GitHub-hosted runners it keeps only `api` providers (+ the built-in heuristic), since local agent CLIs can't be authenticated there. Set `cli` explicitly if your workflow preinstalls and authenticates agent CLIs. | no | auto |
| inline-comments | Whether to post findings as inline review comments on changed lines. | no | false |
| inline-comment-limit | Maximum number of inline review comments to post per run. | no | 10 |
| baseline | Deprecated compatibility input. A canonical .quorate.baseline.json on the base branch is applied automatically when valid and unexpired; PR input cannot enable, disable, or redirect it. | no | false |
| baseline-path | Canonical trusted baseline path; alternate paths are rejected. | no | .quorate.baseline.json |
| suppress-path | Canonical trusted suppression-store path. Alternate paths are rejected; accepted-risk findings remain visible but ungated. | no | .quorate/suppressions.json |
| policy-path | Canonical trusted VerdictGate policy path. Alternate paths are rejected; the base policy defines fail-on, agreement, required roles, and provider floor. | no | .quorate/policy.yml |
| include-pr-context | Include redacted PR title/body/commit context in reviewer prompts. The context is treated as untrusted read-only text and byte-capped. | no | false |
| reviewgraph | Include ReviewGraph agreement evidence in the PR comment and job summary. | no | false |
| reviewgraph-file | Path to write ReviewGraph agreement evidence as JSON. Empty disables the sidecar export. | no | "" |
| sarif-file | Path to write a SARIF 2.1.0 report. The written path is exposed as the `sarif-path` output; add a downstream `github/codeql-action/upload-sarif` step to publish it to the Security tab. Empty disables SARIF output. | no | "" |