Vulnetix/cli/config-plan action

The Vulnetix/cli/config-plan GitHub Action: inputs, outputs, permissions and a complete workflow with artifact upload and attestation.

Installs the CLI, plans the Platform IaC documents against the config engine, writes the plan to the job summary and, on a pull request, to one comment. With validate-only: true it runs vulnetix config validate offline instead.

steps:
  - uses: actions/checkout@v5
  - uses: Vulnetix/cli/config-plan@v4
    with:
      config-token: ${{ secrets.VULNETIX_CONFIG_TOKEN }}

Runs vulnetix config plan -o json [-f <config-path>]... [--manager] [--prune]. The credential is config-token, which reaches the CLI only as the environment variable VULNETIX_CONFIG_TOKEN; see Credentials.

Inputs

Input	Description	Default
`version`	Release of the Vulnetix CLI to install: an exact tag (v4.0.0), a major channel (v4, the newest v4 release) or latest	`v4`
`binary-path`	Path to an already-built vulnetix binary to use instead of downloading a release	-
`org-id`	Vulnetix organization ID (UUID), used with api-key. Optional: without credentials the CLI runs in community mode	-
`api-key`	Vulnetix API key. Passed to the CLI as VULNETIX_API_KEY, never on the command line	-
`api-token`	Vulnetix API token; the server resolves the organization. Passed as VULNETIX_API_TOKEN	-
`artifact-name`	Upload every file the command wrote as a workflow artifact with this name	-
`fail-on-findings`	Fail the step when the command exits non-zero (findings over a gate, a breach, an error): true or false. The artifact, attestation and publish steps run either way	`true`
`github-token`	Token for GitHub publishing, release assets and pull request comments	`${{ github.token }}`
`attest`	Attest the written files with GitHub artifact attestations (needs id-token: write and attestations: write): true or false	`false`
`release-tag`	Attach every file the command wrote to the GitHub release with this tag (needs contents: write)	-
`config-token`	Config management token (vmt_…). Passed to the CLI as VULNETIX_CONFIG_TOKEN, never on the command line	-
`config-path`	Config documents, one file or directory per line (default: .vulnetix/config)	-
`config-manager`	Manager the documents are declared by (default: gitops:<owner/repo> of this repository)	-
`config-prune`	Delete objects this manager owns that the documents no longer declare: true or false	`false`
`validate-only`	Validate the documents offline (vulnetix config validate) instead of planning: true or false	`false`

Outputs

Output	Description
`files`	Every file the command wrote, one per line
`sarif`	The SARIF files it wrote, one per line
`sbom`	The CycloneDX SBOM it wrote, if any
`manifest`	The artifact manifest (JSON Lines) listing what it wrote
`exit-code`	The command’s exit code
`result`	success or failure
`summary`	One line saying what ran and how it ended

Permissions

contents: read to check out the repository
id-token: write and attestations: write with attest: true
contents: write with release-tag
pull-requests: write to comment the plan on a pull request

Example workflow

name: Config plan
on:
  pull_request:
    paths: ['.vulnetix/**']
jobs:
  plan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write     # the plan comment
    steps:
      - uses: actions/checkout@v5
      - uses: Vulnetix/cli/config-plan@v4
        id: plan
        with:
          config-token: ${{ secrets.VULNETIX_CONFIG_TOKEN }}
      - name: Show the counts
        if: ${{ !cancelled() }}
        env:
          RESULT: ${{ steps.plan.outputs.result }}
          SUMMARY: ${{ steps.plan.outputs.summary }}
        run: echo "$RESULT: $SUMMARY"

artifact-name uploads every file the command wrote as one workflow artifact. attest: true attests those files with GitHub artifact attestations.

Behaviour

The token is config-token (vmt_...), passed as VULNETIX_CONFIG_TOKEN, never on the command line. org-id and api-key are not needed for this action.
config-path is one file or directory per line, each passed as -f. With none, no -f is passed and the CLI reads its defaults: .vulnetix/config and, with CLI v4, the well-known files. config-manager defaults to gitops:<owner/repo>, lowercased, from GITHUB_REPOSITORY.
The job summary gets the plan as a table, then blocking conditions and warnings, then the counts. On pull_request the same text goes to one comment that starts with ; each push updates that comment instead of adding another. A fork’s read-only token cannot comment: that is a warning and the summary still has the plan.
result is success, blocked (exit code 3, the plan has blocking conditions) or failure. summary is the plan’s counts, for example 0 to create, 1 to update, 0 to delete, 0 unchanged.
Which files are read: Which files are Platform IaC documents. With no config-path, plan reads .vulnetix/config and the well-known files from CLI v4.0.0 (v3 read .vulnetix/config only). Any config-path is passed as -f, which reads only what it names. See Migrating from v3 to v4.
The action needs jq on the runner.