env, not in with. An action input is echoed into the run’s
command line under some runner configurations, and a secret on a command line
is readable by every other process on the runner.
The key
One key per pipeline, with the minimum scopes:
Not
findings:suppress — a runner that can queue scans has no business being
able to silence its own failures. policies:manage is not grantable to a key
at all, so the pipeline cannot rewrite the policy that judges it.
Inputs
Outputs
The pull request comment
With a GitHub App installed on the repository and its installation id supplied, a gate run on a pull request leaves one comment and replaces it on every later push. Replaces, not appends: a pull request is pushed to, every push runs the gate, and a comment per push means the twentieth commit buries the current verdict under nineteen stale ones. The comment is found by a hidden marker, so the gate never edits anybody else’s comment — including one that quotes it. Without an App, or on apush build rather than a pull_request one, the gate
still runs and still fails the job. The verdict is the point; the comment is the
convenience.
Rolling a policy out
fail-on-block: false reports the decision and lets the build continue. Run it
that way for a sprint, read the comments, then flip it.
Self-hosted runners
The action downloads one static binary for the runner’s OS and architecture —linux/darwin, amd64/arm64 — so it works on self-hosted runners without
a Docker daemon. A runner with no route to GitHub releases should run the CLI
from the backend image instead; see trustivan.