pathInput
Repository path to scan. Mutually exclusive with docker-archive, oci-archive, and registry-image. Empty defaults to the GitHub workspace when no other source is selected.
- Required
- false
- Default or value
- -
GitHub Action Reference
This page is generated from action.yml.
Inputs
Section titled “Inputs”docker-archiveInput
Docker image archive produced by docker save. Relative paths resolve from the GitHub workspace.
- Required
- false
- Default or value
- -
oci-archiveInput
OCI image-layout archive. Relative paths resolve from the GitHub workspace.
- Required
- false
- Default or value
- -
registry-imageInput
OCI or Docker registry image reference, including Docker Hub shorthand.
- Required
- false
- Default or value
- -
registry-endpointInput
Optional OCI Distribution API endpoint override. Requires registry-image.
- Required
- false
- Default or value
- -
registry-auth-endpointInput
Optional explicitly trusted cross-host bearer-token endpoint. Requires registry-image.
- Required
- false
- Default or value
- -
registry-token-envInput
Environment variable containing a pre-issued registry bearer token. Requires registry-image and cannot be combined with Basic authentication inputs.
- Required
- false
- Default or value
- -
registry-username-envInput
Environment variable containing the registry username. Requires registry-image and registry-password-env.
- Required
- false
- Default or value
- -
registry-password-envInput
Environment variable containing the registry password or personal access token. Requires registry-image and registry-username-env.
- Required
- false
- Default or value
- -
registry-platformInput
Optional os/architecture[/variant] selector for a multi-platform registry image.
- Required
- false
- Default or value
- -
registry-max-image-megabytesInput
Optional positive aggregate download cap for unique image manifests, configs, and layers in decimal MB.
- Required
- false
- Default or value
- -
allow-non-public-source-endpointsInput
Permit private, loopback, link-local, or otherwise non-public registry endpoint addresses.
- Required
- false
- Default or value
false
allow-insecure-source-endpointsInput
Permit HTTP registry endpoints for explicitly trusted environments. Credentials may be sent in cleartext.
- Required
- false
- Default or value
false
config-pathInput
Optional config path. A custom config replaces Picket's embedded native default rules; extend.useDefault restores only the Gitleaks defaults.
- Required
- false
- Default or value
- -
baseline-pathInput
Optional Gitleaks-compatible baseline path.
- Required
- false
- Default or value
- -
ignore-pathInput
Optional .picketignore path containing native stable finding fingerprints or content hashes.
- Required
- false
- Default or value
- -
rule-packsInput
Optional comma-separated built-in rule packs. Values are picket-strict and picket-experimental.
- Required
- false
- Default or value
- -
cacheInput
Restore and save the native Picket scan cache.
- Required
- false
- Default or value
true
cache-modeInput
Native scan cache storage mode. Use secret-hash-only for public CI safety or raw for exact cached report replay in trusted jobs.
- Required
- false
- Default or value
secret-hash-only
cache-pathInput
Native Picket scan cache directory. Empty uses the runner temporary directory.
- Required
- false
- Default or value
- -
cache-keyInput
Optional explicit cache key.
- Required
- false
- Default or value
- -
report-directoryInput
Directory where SARIF and JSONL reports are written. Empty uses the runner temporary directory.
- Required
- false
- Default or value
- -
fail-onInput
Failure mode. Use findings, errors, or never.
- Required
- false
- Default or value
findings
summaryInput
Write the Picket scan job summary.
- Required
- false
- Default or value
true
resultsInput
Optional comma-separated validation result states to keep before reports, annotations, and failure enforcement.
- Required
- false
- Default or value
- -
only-verifiedInput
Keep only structurally valid offline findings and active live-verification findings.
- Required
- false
- Default or value
false
verifyInput
Enable opt-in live provider verification.
- Required
- false
- Default or value
false
live-max-requestsInput
Maximum outbound live-verification requests per scan.
- Required
- false
- Default or value
100
live-max-requests-per-providerInput
Maximum outbound live-verification requests for any one provider per scan.
- Required
- false
- Default or value
25
upload-sarifInput
Upload the SARIF report through GitHub code scanning.
- Required
- false
- Default or value
false
annotationsInput
Emit safe GitHub workflow annotations from JSONL findings.
- Required
- false
- Default or value
true
annotation-limitInput
Maximum number of workflow annotations to emit.
- Required
- false
- Default or value
50
redactInput
Redaction percentage from 0 through 100. Defaults to full redaction for public CI safety.
- Required
- false
- Default or value
100
max-target-megabytesInput
Optional maximum file size in decimal MB for content rules.
- Required
- false
- Default or value
- -
timeoutInput
Optional scan timeout in seconds. Use 0 to disable.
- Required
- false
- Default or value
- -
max-archive-depthInput
Optional maximum nested archive traversal depth. Use 0 to disable.
- Required
- false
- Default or value
- -
max-archive-entriesInput
Optional maximum number of files extracted from archives. Use 0 to disable.
- Required
- false
- Default or value
- -
max-archive-megabytesInput
Optional maximum decompressed archive payload in decimal MB.
- Required
- false
- Default or value
- -
max-archive-ratioInput
Optional maximum archive expansion ratio. Use 0 to disable.
- Required
- false
- Default or value
- -
dotnet-versionInput
.NET SDK version used to run the source-based action.
- Required
- false
- Default or value
10.0.302
setup-dotnetInput
Install the configured .NET SDK before running Picket.
- Required
- false
- Default or value
true
Outputs
Section titled “Outputs”exit-codeOutput
Raw Picket scanner exit code.
- Required
- -
- Default or value
${{ steps.run.outputs.exit-code }}
findingsOutput
Number of JSONL finding records emitted by Picket.
- Required
- -
- Default or value
${{ steps.run.outputs.findings }}
sarif-pathOutput
SARIF report path.
- Required
- -
- Default or value
${{ steps.run.outputs.sarif-path }}
jsonl-pathOutput
JSONL report path.
- Required
- -
- Default or value
${{ steps.run.outputs.jsonl-path }}
annotationsOutput
Number of workflow annotations emitted.
- Required
- -
- Default or value
${{ steps.run.outputs.annotations }}