Straitjacket

GitHub Action

The PowderworksCode/straitjacket GitHub Action installs the prebuilt binary and runs it over your checked-out repository in one self-contained pass. It fails the step on any error-level finding. For a walkthrough see Add Straitjacket to CI; this page is the input reference.

Usage

permissions:
  contents: read
steps:
  - uses: actions/checkout@v5
  - uses: PowderworksCode/straitjacket@v0.1.1
    with:
      version: "v0.1.1"        # pin the scanner too — see the note below
      paths: "src tests"
      skip: "motion"

Pin the full version on both the uses: line (@v0.1.1, the Action wrapper) and the version: input (v0.1.1, the scanner binary). Left unset, version defaults to latest, so a new release applies its new rules the moment it ships — failing an unrelated PR on a rule you never opted into. Bump both, deliberately.

Inputs

Every command-line option has an input, so a workflow configures the scan in YAML rather than by assembling an argument string. Each input is optional; blanks fall back to Straitjacket's own defaults, including a committed straitjacket.toml.

input default meaning
version latest Release tag to install, such as v0.1.1. Pin a tag; latest floats and applies new rules the moment they ship.
paths . Files or directories to scan.
only none Run only these rules.
skip none Disable these rules.
format text Output written to the log — text, json, or sarif.
max-lines config Maximum lines per file. 0 disables file-size.
max-nesting config Maximum indentation depth. 0 disables deep-nesting.
no-comments false Enable the opt-in no-comments rule.
include-json false Scan JSON files, which are skipped by default.
no-ignore false Scan what ignore files and the hidden-file convention exclude.
config discovered Use this configuration file instead of discovering one.
no-config false Ignore checked-in configuration.
sarif-file none Write a SARIF report to this path. Empty writes none.
fail-on-findings true Fail the step on error-level findings.
fail-on-unused-markers true Report suppression markers that suppress nothing.
token none Only needed while the repository is private.

paths, only, and skip take either a list or a single line, so both of these mean the same thing:

  with:
    paths: src tests
    only: color,emoji

  with:
    paths: |
      src
      tests
    only: |
      color
      emoji

A boolean input must be exactly true or false. True or yes is an error rather than a silent false, because a scanner that quietly stops enforcing is worse than one that fails.

Outputs

output meaning
exit-code The Straitjacket exit code — 0 clean, 1 findings, 2 operational failure — so a later step can branch on the result even when fail-on-findings is off.

SARIF

The Action writes the SARIF file; the upload is a step you add, and that is what needs security-events: write:

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v5
  - uses: PowderworksCode/straitjacket@v0.1.1
    with:
      sarif-file: straitjacket.sarif
      fail-on-findings: "false"
  - uses: github/codeql-action/upload-sarif@v3
    with:
      sarif_file: straitjacket.sarif

Set fail-on-findings: "false" on the scan step, or a failing scan ends the job before the upload runs and you get the gate without the annotations. See SARIF / inline PR annotations.

Notes