pqc-tools/action.yml at main · quantakrypto/pqc-tools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
# Root action metadata so the Action can be published to the GitHub Marketplace
# (Marketplace only lists an action whose action.yml is at the repository root).
# It reuses the SAME bundle as packages/action (main points at that dist), so
# there is one source of truth for the code. Both entrypoints work:
#   uses: quantakrypto/pqc-tools@v1                 (this file, Marketplace)
#   uses: quantakrypto/pqc-tools/packages/action@v1 (unchanged)
# Keep the inputs/outputs here in sync with packages/action/action.yml.
name: "quantakrypto Quantum Readiness Scan"
description: "Fail CI when new quantum-vulnerable cryptography lands. Scans code, writes SARIF, gives PQC migration guidance."
author: "quantakrypto"
branding:
  icon: "shield"
  color: "green"

inputs:
  checks:
    description: >-
      Which checks to run: any comma-separated subset of "scan" (qScan static
      analysis), "conformance" (Sieve, FIPS 203/204/205) and "probe" (qProbe,
      live TLS/SSH). Defaults to "scan", which is what this action did before
      this input existed, so an existing workflow keeps working unchanged. That
      is why adding it did not move the @v1 tag: it is not a breaking change.
    required: false
    default: "scan"
  probe-target:
    description: >-
      Hostname of a TLS/SSH endpoint you own, e.g. api.example.com. A full URL is
      accepted and reduced to its host. Required when "probe" is in checks.
    required: false
    default: ""
  i-own-this:
    description: >-
      Attest that you are authorised to probe "probe-target". Required when
      "probe" is in checks. This is an explicit statement by whoever edits this
      workflow, exactly as the qProbe CLI requires; the action will not make it
      on your behalf. Active probing of endpoints you do not own may be unlawful.
    required: false
    default: "false"
  conformance-impl:
    description: >-
      Command that runs your ML-KEM/ML-DSA/SLH-DSA implementation, e.g.
      "node ./impl.js". Sieve drives it over stdin/stdout JSON, so it must exist
      in this repository. Required when "conformance" is in checks.
    required: false
    default: ""
  conformance-param:
    description: >-
      Parameter set for the conformance battery, e.g. ml-kem-768, ml-dsa-65,
      slh-dsa-sha2-128s.
    required: false
    default: "ml-kem-768"
  mode:
    description: >-
      "scan" (default) writes a report and gates the build; "comment-plan" posts
      a deterministic PQC migration plan as a PR comment and never fails the build.
    required: false
    default: "scan"
  path:
    description: "Directory (or file) to scan, relative to the repository root."
    required: false
    default: "."
  ignore:
    description: >-
      Extra paths to exclude, comma- or newline-separated (repeatable `--ignore`
      on the CLI). Useful for content, fixtures or docs that DESCRIBE cryptography
      without using it: those match the detectors and become findings you never
      wanted scanned. A baseline is the wrong tool for that, because it records
      them as known debt rather than as not-code.
    required: false
    default: ""
  include:
    description: >-
      Restrict the scan to paths matching these patterns, comma- or
      newline-separated. When empty, everything not excluded is scanned.
    required: false
    default: ""
  severity-threshold:
    description: >-
      Minimum severity that counts as a failure: critical, high, medium, low,
      or info. Findings strictly below this level never fail the build.
    required: false
    default: "high"
  fail-on-findings:
    description: >-
      When "true", exit non-zero if any finding at or above the
      severity-threshold is present. Set to "false" to report only.
    required: false
    default: "true"
  format:
    description: 'Report format written to "output". One of: sarif, json.'
    required: false
    default: "sarif"
  output:
    description: "Path of the report file to write (relative to the workspace)."
    required: false
    default: "quantakrypto.sarif.json"
  baseline:
    description: >-
      Optional path to a baseline file written by `qscan --write-baseline`
      (a {version, fingerprints} file, NOT a scan report). Findings listed in it
      are suppressed, so only NEW quantum-vulnerable crypto fails the build.
      Pointing this at a SARIF/JSON report loads zero fingerprints and suppresses
      nothing.
    required: false
  comment-pr:
    description: >-
      When "true" and a github-token plus pull-request context are available,
      post a summary comment on the pull request. Never fails the build.
    required: false
    default: "false"
  github-token:
    description: >-
      Token used to comment on the pull request (only needed when
      comment-pr is "true"). Typically the workflow's built-in GITHUB_TOKEN.
    required: false
  redact-snippets:
    description: >-
      When "true", omit the matched source snippet from every finding in the
      written report. Snippets of sensitive findings (e.g. embedded key
      material) are ALWAYS omitted regardless of this setting.
    required: false
    default: "false"
  mandate:
    description: >-
      Comma- or space-separated compliance mandate ids to gate findings against
      (e.g. "cnsa-2.0,nist-ir-8547"). Deadline-aware: every mandate-prohibited
      finding is reported with its clause and deadline, but the build only fails
      once a DISALLOW deadline has passed (or early, via lead-months / fail-now).
      Independent of fail-on-findings. Empty disables the mandate gate.
    required: false
    default: ""
  lead-months:
    description: >-
      Fail early when a mandate deadline is within this many months. Only
      meaningful together with "mandate".
    required: false
    default: ""
  fail-now:
    description: >-
      When "true", fail on any mandate-prohibited finding immediately,
      regardless of its deadline. Only meaningful together with "mandate".
    required: false
    default: "false"
  policy:
    description: >-
      Path to an org cryptography policy JSON (same file the CLI's --policy
      takes), relative to the workspace. When set alongside "mandate", families
      the policy explicitly permits or is transitioning are annotated in the
      report and exempted from the early gate (lead-months / fail-now); a passed
      DISALLOW deadline still fails. Empty disables the composition.
    required: false
    default: ""

outputs:
  findings-count:
    description: "Number of findings at or above the severity threshold (after baseline)."
  sarif-file:
    description: "Path of the report file that was written."
  readiness-score:
    description: "Post-quantum readiness score from 0 (worst) to 100 (no classical asymmetric crypto found)."

runs:
  using: "node24"
  main: "packages/action/dist/index.js"