Korext Enforce Action

Enforce security, compliance, and quality standards on AI-generated code directly in your GitHub workflows. Korext scans your codebase against policy packs and surfaces violations as GitHub Code Scanning annotations on pull requests.

Quick Start

Add this to .github/workflows/korext.yml:

name: Korext Enforcement
on: [push, pull_request]

permissions:
  contents: read
  security-events: write

jobs:
  enforce:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Korext/enforce-action@v1

That's it. Korext scans your code on every push and PR using the default web policy pack.

How It Works

1. Install -- The action installs the Korext CLI (v0.9.5)
2. Scan -- Runs korext enforce against your codebase with the selected policy pack
3. Report -- Generates a SARIF file and uploads it to GitHub Code Scanning
4. Gate -- Fails the workflow if critical or high severity violations are found

Violations appear as annotations directly on the PR diff, powered by GitHub Code Scanning.

Inputs

Outputs

Examples

Basic usage (anonymous mode)

- uses: actions/checkout@v4
- uses: Korext/enforce-action@v1

With authentication

- uses: actions/checkout@v4
- uses: Korext/enforce-action@v1
  with:
    api-token: ${{ secrets.KOREXT_API_TOKEN }}

Custom policy pack

- uses: actions/checkout@v4
- uses: Korext/enforce-action@v1
  with:
    pack: owasp-top-10

Scan a subdirectory

- uses: actions/checkout@v4
- uses: Korext/enforce-action@v1
  with:
    directory: src/

Warn but don't fail

- uses: actions/checkout@v4
- uses: Korext/enforce-action@v1
  with:
    fail-on-violations: 'false'

PR-only enforcement

name: Korext PR Check
on: pull_request

permissions:
  contents: read
  security-events: write

jobs:
  enforce:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Korext/enforce-action@v1
        with:
          pack: web

Use violation count in downstream steps

- uses: actions/checkout@v4
- uses: Korext/enforce-action@v1
  id: korext
  with:
    fail-on-violations: 'false'
- run: echo "Found ${{ steps.korext.outputs.violations }} violations"

Permissions

Your workflow must include:

permissions:
  contents: read          # Checkout repository
  security-events: write  # Upload SARIF to Code Scanning

Without security-events: write, SARIF upload will be skipped.

Rate Limits

Each workflow run consumes 1 request (one korext enforce call). Anonymous mode is sufficient for most open-source projects. For high-traffic repos with many PRs, use an API token.

Code Scanning

When sarif-upload is true (the default), the action uploads SARIF results to GitHub Code Scanning. Violations appear as annotations on the PR diff with severity levels:

• Error -- Critical and high severity violations
• Warning -- Medium severity violations
• Note -- Low severity violations

Note: GitHub Code Scanning is free for public repositories. Private repositories require GitHub Advanced Security.

Supported File Types

Korext scans the following file types:

.ts .tsx .js .jsx .py .go .java .rs

The scanner automatically skips node_modules, .git, dist, build, and .next directories.

Exit Codes

Links

• Korext Platform
• Korext CLI on npm
• Korext Website

License

MIT