1. Documentation
  3. Configuration
  5. Action inputs
ReadmeMarketplaceGitHub
  • Introduction
  • Quickstart
  • Supported providers
  • API-key providers
  • GitHub Copilot
  • OpenAI Codex
  • Amazon Bedrock
  • Action inputs
  • Reporting and severity
  • Audit lifecycle
  • Incremental audits
  • Safety boundaries
  • Troubleshooting

Action inputs

Configure providers, checks, reports, scope, and incremental audits.

Loading documentation…

Amazon Bedrock< PreviousReporting and severityNext >

Powered by heyo

On this page

Provider and authenticationAudit policyReporting and scale

Inputs are set under with: on heyo-sh/heyo-code-audit@v1. Empty optional values use their default.

Provider and authentication

InputRequiredDefaultDescription
providerNoopenaiPi provider identifier.
modelYes—Provider-specific model identifier. No model fallback is selected.
auth-typeYes—api-key, oauth, aws, or bedrock-bearer.
auth-tokenExcept aws—API key, OAuth access token, or Bedrock bearer token.
aws-regionNo—Optional AWS region for Amazon Bedrock.
aws-profileNo—Optional AWS shared-config profile for Amazon Bedrock AWS credentials.
github-tokenYes—Token used to read pull-request metadata and publish reports.

The valid authentication method depends on the provider: API-key providers require api-key; github-copilot and openai-codex require oauth; and amazon-bedrock supports aws or bedrock-bearer.

Audit policy

InputDefaultDescription
checksAll four checksComma-separated security, regression, functional, and nonfunctional.
verificationtrueVerify each candidate finding in a separate Pi session before reporting it.
fail-onhighLowest severity that makes the Check fail: never, low, medium, high, or critical.
pathsEntire repositoryComma-separated repository globs to include.

For example, only inspect source and infrastructure files without failing the workflow for verified findings:

yaml
with:  checks: security,regression  paths: src/**,.github/**  fail-on: never

Reporting and scale

InputDefaultDescription
reportcheck-and-commentcheck, comment, check-and-comment, or none.
comment-on-cleanfalseSubmit a clean pull-request review when no findings are verified.
incrementaltrueReuse compatible completed-Check state on later pushes.
max-pr-commits100Maximum commits in a full audit, or unlimited.
max-new-commits20Maximum new commits in an incremental audit, or unlimited.

Set verification: false only when you intentionally accept discovery findings without separate verification. Use unlimited only if your repository policy permits it. Invalid provider, model, authentication, check, path, and limit values fail before Heyo starts an audit.