cryptarium scan

Purpose: Resolve the target (local path or public HTTPS git URL), walk the tree, run all detectors, correlate, classify, score, and write requested outputs.

Synopsis

cryptarium scan [flags] <path|git-url>

Worked example

# Local path
cryptarium scan .

# Public HTTPS repository (requires git on PATH)
cryptarium scan https://github.com/OWNER/REPO

cryptarium scan ./services/payments \
  --format markdown \
  --format sarif \
  --output out/ \
  --fail-on high

- uses: sgoveia/cryptarium@v0.3.0
  with:
    path: .
    fail-on: critical
    upload-sarif: true

Notes

Public HTTPS remotes are shallow-cloned (git clone --depth 1 --single-branch) into a temp directory, scanned, then removed. git must be on PATH.
SSH and private/authenticated remotes are not supported yet (roadmap). Use an HTTPS URL for public repos, or clone privately yourself and pass a local path.
Finding paths are relative to the scan root; report metadata keeps the original URL or path as the target.
Unparseable files produce warnings — they are not silently skipped.