delimit_security_ingest
Ingest external security scan output and normalize into ledger findings to gate deploys on unresolved criticals.
Instructions
Ingest external security scan output and normalize into ledger findings (Pro).
When to use: after running a scanner externally — Trivy, Semgrep, npm-audit, pip-audit, Snyk, CodeQL — to feed its JSON output into Delimit's canonical schema and gate deploys on unresolved criticals. When NOT to use: to run a scan from scratch (use delimit_security_scan) or to triage findings (delimit_security_deliberate).
Sibling contrast: delimit_security_scan runs the built-in scan; delimit_security_deliberate triages findings; this is the bridge that pulls external scanner output into the same ledger.
Side effects: gated by require_premium. Writes findings to the ledger (creates new items, optionally closes resolved ones). Computes a stable fingerprint per finding to enable diffing.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tool | Yes | Scanner name — one of "trivy", "semgrep", "npm-audit", "pip-audit", "snyk", "codeql". Required. | |
| results | Yes | JSON string of scan results, or path to a JSON file. Required. | |
| repo | No | "owner/repo" identifier. Empty = auto-detect. | |
| commit_sha | No | Git SHA the scan ran against. Empty = auto-detect. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||