GitHub - Actenon/actenon-scan: Find where agent-controlled intent reaches consequential actions without an authority che

How to generate a fix?

actenon-scan fix path/to/file.py:42 # auto-select mode, print diff actenon-scan fix path/to/file.py:42 --mode guard # repository-native guard actenon-scan fix path/to/file.py:42 --mode approval # framework approval actenon-scan fix path/to/file.py:42 --mode actenon # Actenon proof verification actenon-scan fix path/to/file.py:42 --apply # write the change Remediation is offered in neutral order: repository-native.

How to add it to a PR?

GitHub Action (sticky comment + SARIF, zero config) # .github/workflows/actenon-scan.yml name: actenon-scan on: pull_request: push: branches: [main] schedule: - cron: '0 6 * * *' jobs: scan: runs-on: ubuntu-latest permissions: pull-requests: write # for the sticky comment security-events: write # for SARIF upload to Security tab contents: read steps: - uses: actions/checkout@v4 with: fetch-depth: 0 # required for.

How to export reports?

actenon-scan scan . --format html --output report.html # self-contained HTML actenon-scan scan . --format markdown --output report.md # GitHub issue / PR actenon-scan scan . --format sarif --output report.sarif # GitHub code scanning actenon-scan scan . --format list # old linter-style list actenon-scan scan .

How to suppress or baseline known findings?

# Suppress a single finding inline — BOTH syntaxes are accepted: # actenon-scan: ignore[REPOSITORY-MUTATION] # actenon-scan: suppress REPOSITORY-MUTATION # Baseline known findings: actenon-scan scan . --baseline known-findings.json # Generate a baseline from the current scan (locks in today's findings # so only NEW findings appear in future scans): actenon-scan baseline . --output known-findings.json

How to configure custom guards?

# Register a guard by name without a config file: actenon-scan scan . --guard my_authorize --guard require_permission # Or use a config file: actenon-scan scan . --config actenon-scan.json actenon-scan init --format json # write a default config Custom sinks and reachability signals (config-only, no code changes) You can extend detection without forking the repo.