name: GuardModel Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: guardmodel/scan@v1

version: 1

# Directories to scan
include:
  - models/
  - weights/

# Directories to ignore
exclude:
  - tests/fixtures/

# Severity threshold to fail CI
fail_on: high  # critical, high, medium, low, none

# Allowlist known-safe models by SHA256
allowlist:
  - sha256: "abc123..."
    reason: "Verified by security team"

# Maximum file sizes
max_file_size: 5GB
max_total_size: 20GB

# Install dependencies
npm install
pip install -r requirements.txt

# Build
npm run build

# Test
npm test
pytest tests/

# Package for release
npm run package

guardmodel/
├── action.yml              # GitHub Action definition
├── src/                    # TypeScript source
│   ├── index.ts           # Entry point
│   ├── orchestrator.ts    # Scan coordination
│   ├── config.ts          # Configuration
│   ├── walker.ts          # File discovery
│   └── reporters/         # Output formatters
├── python/
│   ├── agents/            # Scanner agents
│   │   ├── pickle_agent.py
│   │   ├── keras_agent.py
│   │   ├── onnx_agent.py
│   │   └── safetensors_agent.py
│   └── rules/             # Detection rules
└── tests/                 # Test suite