vaultcompasshq/Vault Guard
Scan a repository for secrets with @vaultcompass/vault-guard (SARIF-friendly). Requires a prior actions/checkout of your repo.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | npm dist-tag or semver for @vaultcompass/vault-guard. Validated against `^(latest|next|beta|[0-9A-Za-z.+-]{1,64})$` to prevent npm-tag / shell injection via attacker-controlled workflow inputs. | no | latest |
| path | Path to scan, relative to the workspace root. Validated against `^[A-Za-z0-9._/-]{1,256}$` and rejected if it contains `..` so it cannot escape `GITHUB_WORKSPACE`. | no | . |
| format | Output format (one of `text`, `json`, `sarif`) | no | sarif |
| sarif-output | Output file path, relative to the workspace root. Validated against `^[A-Za-z0-9._/-]{1,256}$` and rejected if it contains `..`. | no | vault-guard-results.sarif |
Outputs
| name | description |
|---|---|
| results-file | Absolute path to the written results file |