BouncerFox Scan

Version updated for https://github.com/BouncerFox/cli to version v0.9.0.

  • This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

BouncerFox CLI is a command-line tool that scans AI agent configuration files for security, quality, and compliance issues. It analyzes files such as .md files containing skill definitions and Claude context, rule configurations, and plugin manifests to identify potential vulnerabilities and best practices. The tool runs entirely offline, ensuring no data leaves the user’s machine, and supports various output formats including JSON and SARIF for integration with IDEs and CI systems.

What’s Changed

Highlights

  • Make JSON and SARIF finding paths checkout-relative and portable, with deterministic multi-root namespacing and fingerprints stable across checkout directories and operating systems.
  • Improve SARIF output with URL-encoded artifact URIs and correct release-binary version metadata.
  • Fix config resolution so discovery follows the requested scan root, --config loads the exact file, inheritance remains predictable, and invalid profiles or options exit with usage status 2.
  • Enable validated local custom_rules from .bouncerfox.yml, including documented CUSTOM_NNN IDs and project overrides.
  • Harden parsing and limits for malformed YAML/JSON, CRLF input, YAML anchors/aliases/merge keys, the 1 MiB content boundary, and the 500-file boundary.
  • Improve governed-file routing, globs, relative paths, code frames, credential checks, and CI coverage on Windows.

Upgrade notes

  • Evidence-path normalization intentionally changes fingerprints generated by v0.8.0 once. Fingerprints are then stable across checkout roots and operating systems.
  • The built-in rules contract is now 1.0.1.
  • Connected mode remains deliberately disabled in release builds while the CLI/platform policy and integration contract are completed.

Known limitation

The Docker-based GitHub Action still compiles its embedded version as dev, so Action version output and SARIF driver metadata do not report 0.9.0. Downloadable release binaries report 0.9.0 correctly, and scanning behavior is unaffected. Revisit this during Action/release build-parity hardening.