# Action reference

> Markdown source of https://docs.magmamoose.com/chargate/action-reference/.

<!-- sources: action.yml -->

Every input and output of the `magmamoose/chargate` composite action, read from
`action.yml`. For the task-shaped version with worked examples, see
[Setup and usage](https://docs.magmamoose.com/chargate/setup/). For the CLI these inputs drive, see the
[CLI reference](https://docs.magmamoose.com/chargate/cli/).

## Inputs

All 46 inputs are optional. A blank default means the action leaves the
value unset and the CLI's own default applies.

| Input | Default | Description |
| --- | --- | --- |
| `checkout` | `true` | Run actions/checkout first. Net-new gating needs full history (fetch-depth 0). |
| `fetch_depth` | `0` | Checkout fetch-depth. MUST be 0 for net-new gating (merge-base). |
| `mode` | `auto` | auto \| pr (net-new gate) \| baseline (full scan, no gate). |
| `fail_on` | `any` | Severity that blocks: any \| critical \| high \| medium \| low \| none. |
| `precision` | `line` | Net-new precision: line \| file. |
| `base_ref` | (none) | Override the base ref/SHA (default: PR base SHA from the event). |
| `head_ref` | (none) | Override the head ref/SHA (default: PR head SHA, else github.sha). |
| `strict` | `false` | Fail the job if MegaLinter itself errors (a tool error, not a finding). A SARIF with no runs fails regardless. |
| `flavor` | `security` | MegaLinter flavor: security (default) \| all (full lint image) \| python \| go \| ... |
| `megalinter_registry` | (none) | Registry host for the MegaLinter images. Default ghcr.io, MegaLinter froze Docker Hub publishing at v9.4.0, so docker.io cannot serve v9.5.0+ at all. Point this at a mirror or pull-through cache if you have one. |
| `megalinter_namespace` | (none) | Image namespace under the registry. Default oxsecurity. |
| `megalinter_image` | (none) | Full image reference, overriding registry + namespace + flavor + tag entirely. Use it for a MegaLinter custom flavor (e.g. ghcr.io/you/repo/megalinter-custom-flavor:v10.0.0, the supported way to get a single-image arm64 build) or an internal mirror. When set, Chargate never composes an image name. |
| `megalinter_tag` | (none) | MegaLinter image tag, or a `sha256:...` digest to pin. Default v10.0.0 (the immutable release tag, not the floating `v10` alias). |
| `docker_platform` | (none) | Value for `docker run --platform`. Only needed to force emulation, e.g. linux/amd64 on an arm64 runner that has qemu-user-static + binfmt installed. Setting it also tells Chargate you have taken responsibility for the architecture, so it stops substituting the per-linter images. |
| `arch_strategy` | `auto` | How to run MegaLinter when the Docker daemon is not linux/amd64. auto (default): the flavor image on amd64, MegaLinter's per-linter `megalinter-only-*` images (multi-arch from v10.0.0) on arm64. flavor: always the flavor image, fails fast with an actionable error on arm64 instead of `exec format error`. standalone: always per-linter images. fail: refuse to run rather than degrade. |
| `standalone_linters` | (none) | Comma-separated MegaLinter linter keys to run in standalone mode. Default: the SARIF-emitting linters of the selected flavor. |
| `jobs` | (none) | Standalone mode only: how many per-linter containers to run concurrently (CLI default 4). Standalone is what arm64 uses, and 4 concurrent MegaLinter containers is a lot for a small self-hosted node — on a 2-OCPU / 4Gi runner that is the difference between a scan and a scheduling fight. Lower it to 1-2 there. Ignored in flavor mode, which is a single container. |
| `enable_linters` | (none) | Comma-separated MegaLinter linter keys to enable (others off). |
| `disable_linters` | (none) | Comma-separated MegaLinter linter keys to disable. |
| `incremental` | `true` | PR events only: ask MegaLinter to analyze just the files the PR changes (VALIDATE_ALL_CODEBASE=false) instead of the whole repo, faster on large repos. Repository-level scanners may still read the whole repo or history. The net-new gate still uses Chargate's own diff. Baseline (push) scans are always whole-repo. Default on. |
| `ignore_sops_encrypted` | `true` | Ignore secret-scanner hits on SOPS-encrypted values (ENC[AES256_GCM,...]), they are already encrypted and are 100% false positives. A plaintext secret in the same file still gates. Set to false to gate on them anyway. Default on. |
| `emit_sarif_artifact` | `true` | Upload the full SARIF as a build artifact. |
| `sarif_artifact_name` | `chargate-sarif` | Artifact name for the full SARIF. |
| `upload_github_sarif` | `true` | Upload the full SARIF to the GitHub Security tab (needs GHAS on private repos). |
| `github_token` | (none) | Token for the GitHub Security-tab SARIF upload + PR comments. Needs pull-requests: write on the consumer workflow for comments. |
| `pr_comment` | `true` | Post GHAS-style PR comments for net-new findings (PR events only). Needs pull-requests: write. |
| `pr_comment_mode` | `both` | What to post: summary (one updatable comment) \| inline (per-line) \| both. |
| `pr_comment_max_inline` | `50` | Cap on inline comments per run; the rest are listed in the summary. |
| `pr_comment_token` | (none) | Explicit override token used ONLY to author the PR comments (BYO GitHub App via actions/create-github-app-token). Usually unset: with id-token: write the token broker provides a Chargate[bot] token automatically. |
| `token_broker_url` | `https://broker-chargate.magmamoose.com` | Chargate token-broker base URL. With job permission id-token: write and the Chargate App installed, comments are authored by Chargate[bot]. Set empty to disable (fall back to github-actions[bot]). |
| `oidc_audience` | `chargate` | OIDC audience requested for the token-broker exchange (advanced). |
| `defectdojo_url` | (none) | DefectDojo base URL. Set to enable import of the FULL SARIF. |
| `defectdojo_token` | (none) | DefectDojo API token (pass a secret). Used only if defectdojo_url is set. |
| `defectdojo_product` | (none) | DefectDojo product name (auto-created if missing). Defaults to the repo name. |
| `defectdojo_product_type` | `Research and Development` | DefectDojo product type name (used to auto-create a new product). |
| `defectdojo_engagement` | `ci` | DefectDojo engagement name (auto-created if missing). |
| `defectdojo_close_old` | `true` | Close findings no longer present on reimport. |
| `dependency_track_url` | (none) | Dependency-Track base URL. Set to enable the CycloneDX BOM upload (pass a Variable). |
| `dependency_track_api_key` | (none) | Dependency-Track API key (pass a Secret). Needs BOM_UPLOAD (+ PROJECT_CREATION_UPLOAD for auto-create, + VIEW_PORTFOLIO for the PR-comment project link). |
| `dependency_track_project_name` | (none) | Dependency-Track project name (auto-created if missing). |
| `dependency_track_project_version` | (none) | Dependency-Track project version. |
| `dependency_track_auto_create` | `true` | Auto-create the project/version on first upload. |
| `dependency_track_project_tags` | (none) | Extra Dependency-Track project tags, comma-separated. `repo:<name>` is always added: a repo has both a source project and Diatreme's assembled-image project, and a repo building several images produces project names that cannot be mapped back to it. Anything grouping a repo's projects needs that join key. |
| `sbom_only` | `false` | Ship the CycloneDX BOM to Dependency-Track and do nothing else: no MegaLinter, no SARIF, no gate. For consumers whose gate runs on `pull_request` only, which never reaches the BOM upload inside the gate. Push/tag events only. A misconfigured sink fails the job; a Dependency-Track outage only warns unless `strict` is also set. |
| `setup_python` | `true` | Run actions/setup-python. Set false on a runner that already has a suitable Python 3.11+, setup-python only publishes linux/arm64 builds for the Ubuntu 22.04/24.04/26.04 images, so on any other arm64 self-hosted/ARC image it fails with "version not found". Chargate itself is stdlib-only pure Python and runs anywhere. |
| `python_version` | `3.12` | Python version used to run the chargate CLI. |

One `flavor` value is not a MegaLinter flavor: `quality` is a five-linter set Chargate
curates itself and runs as per-linter images on every architecture. See
[The `quality` flavor](https://docs.magmamoose.com/chargate/setup/#the-quality-flavor).

## Outputs

| Output | Description |
| --- | --- |
| `mode` | Resolved run mode (pr \| baseline). |
| `gate_result` | pass \| fail. |
| `net_new_count` | Number of net-new (PR-introduced) findings. |
| `total_count` | Total findings in the full SARIF (net-new + pre-existing). |
| `sarif_path` | Path to the full (unfiltered) SARIF report. |
| `filtered_sarif_path` | Path to the net-new-only SARIF (`chargate-reports/net-new.sarif`). Written on every run, baseline included, where the net-new set is empty by construction. |
| `counts_path` | Path to the counts JSON (`chargate-reports/counts.json`), the versioned document a downstream gate reads. Written on every run. See [Consuming the output](https://docs.magmamoose.com/chargate/consuming-output/). |
| `scan_mode` | How MegaLinter actually ran: flavor (the flavor image) \| standalone (per-linter megalinter-only-* images, the arm64 path) \| provided (an existing SARIF was passed in). Assert on this to fail a release job that would otherwise ship on a reduced scan. |
| `linters_skipped` | Linters standalone mode could not run, with the reason for each (empty otherwise). |

Read them with `steps.<id>.outputs.<name>`:

```yaml
      - uses: magmamoose/chargate@v2
        id: gate
      - if: steps.gate.outputs.scan_mode != 'flavor'
        run: |
          echo "reduced scan: ${{ steps.gate.outputs.linters_skipped }}"
          exit 1
```

That example is the reason `scan_mode` exists: on arm64 the action falls back to
per-linter images, and a release job can refuse to ship on a reduced scan.