Action inputs and outputs

Set audit scope and score

• path selects the repository directory and defaults to .
• min-score sets the required score and defaults to 70.
• fail-on-score controls whether a score below the threshold fails the job and defaults to true.

1- id: vice
2  uses: Webba-Creative-Technologies/vice@v3
3  with:
4    path: apps/web
5    min-score: 85

Control report features

• comment-pr controls the pull-request comment and defaults to true.
• upload-sarif controls Code Scanning upload and defaults to true.
• update-badge controls badge JSON updates and defaults to true.
• badge-path changes the default .github/vice-badge.json destination.
• github-token supplies the GitHub token used by enabled repository features.

Use the outputs

• score and grade summarize the audit.
• Finding-count outputs expose the severity totals.
• report-path points to the generated VICE report.

- run: echo "VICE score: ${{ steps.vice.outputs.score }}"

Match permissions to enabled features

PR comments need pull-requests: write, SARIF upload needs security-events: write, and badge updates need contents: write. Remove a write permission when its feature is disabled and the workflow succeeds without it.