GitHub Action

name: BoardReadyOps

on:
  pull_request:
  push:
    branches: [main]

jobs:
  boardreadyops:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: oaslananka/boardreadyops@9bc8a075d885ad1182e2ad4fcd4c9160f8160c94 # v1.31.2
        with:
          config: boardreadyops.yml

This example pins the reviewed release commit shown above. The public v1.33.0 tag is the current published release, and its action.yml input contract was verified against current main before this reference was updated. Use the immutable SHA when reproducibility matters; the floating v1 alias moves with stable releases.

Inputs

Name	Default	Description
`path`	`.`	Directory to scan.
`project`	``	Explicit .kicad_pro path. If omitted, all discovered projects are scanned.
`config`	`boardreadyops.yml`	Path to boardreadyops.yml.
`mode`	`warn`	warn or enforce
`release-mode`	``	Manufacturing release context. One of prototype, pilot, production. Empty disables release mode behavior.
`safe-mode`	`false`	Disable repository plugins, notifier dispatch, and trusted GitHub write operations for restricted execution.
`require-kicad`	`false`	Fail when kicad-cli is not available.
`kicad-cli`	``	Explicit kicad-cli path.
`bom`	`auto`	BOM source path or "auto".
`pinmap`	``	Pinmap file path. Empty disables pinmap rules.
`variant`	``	KiCad variant name used by variant-aware BoardReadyOps rules.
`gate`	``	Gate name from boardreadyops.yml. Empty auto-detects pull_request, main, or release.
`sarif`	`boardreadyops.sarif.json`	Output SARIF path. Empty disables.
`json`	`boardreadyops.findings.json`	Output JSON findings path. Empty disables.
`markdown`	`boardreadyops.report.md`	Output Markdown report path. Empty disables.
`hbom`	``	Output CycloneDX hardware SBOM path. Empty disables.
`upload-sarif`	`true`	Upload SARIF to GitHub Code Scanning.
`upload-artifacts`	`true`	Upload reports as workflow artifacts.
`comment-pr`	`true`	Post a sticky Markdown comment on pull requests.
`comment-format`	`report`	Pull request comment style. One of report (full Markdown report) or review (compact release-review summary).
`artifact-name`	`boardreadyops`	Workflow artifact name.
`fail-on`	`high`	Severity threshold above which the action exits non-zero. One of critical, high, medium, low, never.
`annotations`	`true`	Emit ::error/::warning workflow annotations.
`log-level`	`info`	Log level. One of debug, info, warn, error, critical, silent.
`log-format`	`text`	Log format. One of text, json.
`log-file`	``	Optional log file path inside the workspace.
`log-file-max-bytes`	``	Rotate the log file after this many bytes. Empty uses the default.
`log-file-retention`	``	Number of rotated log files to keep. Empty uses the default.

Outputs

Name	Description
`findings`	Total finding count.
`critical`	Count of critical findings.
`high`	Count of high findings.
`medium`	Count of medium findings.
`low`	Count of low findings.
`sarif-path`	SARIF output path if produced.
`json-path`	JSON output path if produced.
`markdown-path`	Markdown output path if produced.
`hbom-path`	CycloneDX hardware SBOM output path if produced.

Pull request comments

When comment-pr is enabled, the sticky pull request comment summarizes the current findings. With comment-format: review, BoardReadyOps also attempts an exact-base hardware-impact comparison: the exact pull request base SHA is compared with the exact analyzed head SHA using a BoardReadyOps JSON artifact from the same workflow identity. There is no latest-run or same-branch fallback. If exact-base evidence is unavailable, the comment says so and the current-run decision remains valid. The default report format keeps its existing fabrication-diff behavior when a prior report artifact can be discovered.

Exact-base artifact discovery uses the job-scoped repository GITHUB_TOKEN and needs actions: read. The historical/current detailed report artifacts remain in the target repository; only the bounded structured impact summary is eligible for hosted result publication.

Notifiers

The Action honors the repository notifiers configuration from boardreadyops.yml. Webhook URLs, Telegram bot tokens, and SMTP credentials must be supplied through workflow environment variables or secrets referenced by the configured webhookEnv, botTokenEnv, or smtpEnv names. Delivery is best-effort: missing credentials, severity filters, and notifier failures do not change the Action exit code. Action notifications include a link to the current workflow run when GitHub exposes the run metadata.