vibgrate/Vibgrate Scan
Score how far a repo has drifted and catch supply-chain risk in CI. Emits SARIF to the Security tab and a 0-100 DriftScore. Runs the signed, provenance-verified scanner.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan. | no | . |
| format | Output format (sarif, json, md, ...). | no | sarif |
| output | Output file path. | no | vibgrate.sarif |
| fail-on | Fail the job on findings of this severity or higher (e.g. "error"). Empty = never fail on findings. | no | "" |
| vulns | Also scan installed dependencies for known vulnerabilities (adds --vulns). With fetch-depth:0 on checkout, findings are attributed to the introducing commit. | no | false |
| upload-sarif | Upload the SARIF to GitHub code scanning. Only applies when format is "sarif"; the calling workflow needs `permissions: security-events: write`. | no | false |
| category | Category for the uploaded SARIF, so multiple Vibgrate scans coexist in code scanning. | no | vibgrate |
| args | Additional raw arguments appended to `vibgrate scan`. | no | "" |
| dsn | Optional VIBGRATE_DSN to push results to your workspace dashboard. | no | "" |
| image-tag | Scanner image tag to run (defaults to a pinned, tested release). | no | 2026.722.2 |
| verify | Verify the image cosign signature + provenance before running (requires cosign on the runner). | no | false |
Outputs
| name | description |
|---|---|
| output-file | Path to the written scan output file. |