Use the Marketplace wrapper when you want plugin-scanner in pull requests, release checks, or registry submission workflows.
The action lives in its own repository:
- name: AI plugin quality gate
uses: hashgraph-online/ai-plugin-scanner-action@v1
with:
plugin_dir: "."
mode: scan
fail_on_severity: high
min_score: 80
scan for weighted quality scoringlint for authoring feedback and rule-level findingsverify for runtime and install-surface checkssubmit for artifact-backed submission gatingHigh-value outputs include:
scoregradepolicy_passverify_passmax_severitySARIF upload is supported for GitHub code scanning workflows, and the action can also export submission payloads for downstream registry or review automation.
mode: scan or mode: verifysubmit only when the repository is ready to emit release or registry artifacts- name: Scan plugin
id: plugin_scan
uses: hashgraph-online/ai-plugin-scanner-action@v1
with:
plugin_dir: "."
mode: scan
output_format: sarif
sarif_output: plugin-scanner.sarif
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: plugin-scanner.sarif
The common split is:
hol-guard on developer machines for local harness protectionplugin-scanner in CI for maintainer and release gatesai-plugin-scanner-action when you want the scanner wrapped for GitHub Actions consumersUse the Marketplace wrapper when you want plugin-scanner in pull requests, release checks, or registry submission workflows.
The action lives in its own repository:
- name: AI plugin quality gate
uses: hashgraph-online/ai-plugin-scanner-action@v1
with:
plugin_dir: "."
mode: scan
fail_on_severity: high
min_score: 80
scan for weighted quality scoringlint for authoring feedback and rule-level findingsverify for runtime and install-surface checkssubmit for artifact-backed submission gatingHigh-value outputs include:
scoregradepolicy_passverify_passmax_severitySARIF upload is supported for GitHub code scanning workflows, and the action can also export submission payloads for downstream registry or review automation.
mode: scan or mode: verifysubmit only when the repository is ready to emit release or registry artifacts- name: Scan plugin
id: plugin_scan
uses: hashgraph-online/ai-plugin-scanner-action@v1
with:
plugin_dir: "."
mode: scan
output_format: sarif
sarif_output: plugin-scanner.sarif
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: plugin-scanner.sarif
The common split is:
hol-guard on developer machines for local harness protectionplugin-scanner in CI for maintainer and release gatesai-plugin-scanner-action when you want the scanner wrapped for GitHub Actions consumers