The GitHub Action

A Docker action wrapping garboard gate.

Getting it

The Action is not published on the public GitHub Marketplace, and there is no public garboardai/garboard repository. Garboard is distributed to design partners, and the Action comes with it — you will be given the reference to use.

We are saying this rather than printing a uses: line, because a uses: line pointing at a repository that does not exist is a five-minute waste of your time and a permanent dent in everything else a page claims. Our own README carried exactly that for months.

Inputs

Input	Default	What it does
`path`	`.`	Directory to gate, repository-relative.
`format`	`human`	`human`, `json` or `sarif`.
`advisory-errors`	`false`	Also fail on advisory findings.
`rules`	(empty)	Custom WASM rule directory. Empty means `<path>/.garboard/rules`, skipped when absent. An explicit directory that is missing fails the build.
`plan`	(empty)	A `terraform show -json` artifact. Adds `plan.*` findings.
`output-file`	(empty)	Write the report to a file instead of stdout. Required for SARIF — see below.
`profile`	(empty)	Catalog profiles to enforce. Whitespace- or newline-separated for more than one.
`rule`	(empty)	Catalog rule ids to enforce. Whitespace- or newline-separated.

`output-file` is not optional for SARIF

A Docker action’s stdout cannot be redirected by the workflow that calls it. Without output-file, format: sarif produces a report nothing captures and upload-sarif fails on a missing file. The SARIF page has the working shape.

Several profiles or rules

with:
  profile: |
    aws-security-baseline
  rule: |
    lib.aws.rds_encryption
    lib.aws.ecr_scan_on_push

A YAML block scalar is the readable way to pass more than one; the entrypoint splits on whitespace.

Relationship to the App

Independent, and the same gate. The Action needs no App, no account and no API key. The App needs no CI change. Many teams run both: the Action as the merge gate, the App for the review comment, evidence and Fix.

What it never does

It runs garboard gate over your checked-out working tree. It never runs Terraform, holds no cloud credentials, and makes no outbound call. Producing a plan artifact, if you want plan-aware gating, happens in your own credentialed step — see the gate page.