All flags
Online audits
The online supply-chain audits of pinned actions (known-vulnerable via GHSA, impostor-commit, ref/version-mismatch, typosquat) run automatically when you supply a GitHub token via--github-token, $GITHUB_TOKEN, or $GH_TOKEN — including inside GitHub Actions, where the Pipefort action passes the workflow token for you. Without a token a scan stays fully offline unless you force the audits with --audit-pins. --offline disables them (and the repository-settings audit) unconditionally.
A token that gh auth token would return does not auto-enable the audits — a plain local scan never makes API calls just because the GitHub CLI happens to be logged in. It is still used to authenticate audits you enable explicitly. When a gh login is detected and the scanned workflows pin third-party actions, Pipefort prints a one-line hint that the online audits are available (run --audit-pins or set $GITHUB_TOKEN to turn them on); it never makes the calls unprompted.
Target selection
The CLI picks a target in this order:--git owner/repo— shallow-clone, then scan the temp directory.--file path/to/workflow.yml— scan a single file.--path .— scan the directory’s.github/workflows/, falling back to walking the whole tree if missing.
Exit codes
Severity weighting (lowest to highest):
INFO < LOW < MEDIUM < HIGH. --fail-on NONE always exits 0 on a clean run, regardless of findings — useful when you want a report without gating.