pathInput
Repository path to scan.
- Required
- false
- Default or value
.
GitHub Action Reference
This page is generated from action.yml.
Inputs
Section titled “Inputs”config-pathInput
Optional config path. A custom config replaces Picket's embedded native default rules; extend.useDefault restores only the Gitleaks defaults.
- Required
- false
- Default or value
- -
baseline-pathInput
Optional Gitleaks-compatible baseline path.
- Required
- false
- Default or value
- -
ignore-pathInput
Optional .picketignore path containing native stable finding fingerprints or content hashes.
- Required
- false
- Default or value
- -
rule-packsInput
Optional comma-separated built-in rule packs. Values are picket-strict and picket-experimental.
- Required
- false
- Default or value
- -
cacheInput
Restore and save the native Picket scan cache.
- Required
- false
- Default or value
true
cache-modeInput
Native scan cache storage mode. Use secret-hash-only for public CI safety or raw for exact cached report replay in trusted jobs.
- Required
- false
- Default or value
secret-hash-only
cache-pathInput
Native Picket scan cache directory. Empty uses the runner temporary directory.
- Required
- false
- Default or value
- -
cache-keyInput
Optional explicit cache key.
- Required
- false
- Default or value
- -
report-directoryInput
Directory where SARIF and JSONL reports are written. Empty uses the runner temporary directory.
- Required
- false
- Default or value
- -
fail-onInput
Failure mode. Use findings, errors, or never.
- Required
- false
- Default or value
findings
summaryInput
Write the Picket scan job summary.
- Required
- false
- Default or value
true
resultsInput
Optional comma-separated validation result states to keep before reports, annotations, and failure enforcement.
- Required
- false
- Default or value
- -
only-verifiedInput
Keep only structurally valid offline findings and active live-verification findings.
- Required
- false
- Default or value
false
upload-sarifInput
Upload the SARIF report through GitHub code scanning.
- Required
- false
- Default or value
false
annotationsInput
Emit safe GitHub workflow annotations from JSONL findings.
- Required
- false
- Default or value
true
annotation-limitInput
Maximum number of workflow annotations to emit.
- Required
- false
- Default or value
50
redactInput
Redaction percentage from 0 through 100. Defaults to full redaction for public CI safety.
- Required
- false
- Default or value
100
max-target-megabytesInput
Optional maximum file size in decimal MB for content rules.
- Required
- false
- Default or value
- -
timeoutInput
Optional scan timeout in seconds. Use 0 to disable.
- Required
- false
- Default or value
- -
max-archive-depthInput
Optional maximum nested archive traversal depth. Use 0 to disable.
- Required
- false
- Default or value
- -
max-archive-entriesInput
Optional maximum number of files extracted from archives. Use 0 to disable.
- Required
- false
- Default or value
- -
max-archive-megabytesInput
Optional maximum decompressed archive payload in decimal MB.
- Required
- false
- Default or value
- -
max-archive-ratioInput
Optional maximum archive expansion ratio. Use 0 to disable.
- Required
- false
- Default or value
- -
dotnet-versionInput
.NET SDK version used to run the source-based action.
- Required
- false
- Default or value
10.0.301
setup-dotnetInput
Install the configured .NET SDK before running Picket.
- Required
- false
- Default or value
true
Outputs
Section titled “Outputs”exit-codeOutput
Raw Picket scanner exit code.
- Required
- -
- Default or value
${{ steps.run.outputs.exit-code }}
findingsOutput
Number of JSONL finding records emitted by Picket.
- Required
- -
- Default or value
${{ steps.run.outputs.findings }}
sarif-pathOutput
SARIF report path.
- Required
- -
- Default or value
${{ steps.run.outputs.sarif-path }}
jsonl-pathOutput
JSONL report path.
- Required
- -
- Default or value
${{ steps.run.outputs.jsonl-path }}
annotationsOutput
Number of workflow annotations emitted.
- Required
- -
- Default or value
${{ steps.run.outputs.annotations }}