microsoft/ps-rule

microsoft/ps-rule

Description: Validate infrastructure as code (IaC) and DevOps repositories using GitHub Actions.

Language: PowerShell

License: MIT

Stars: 90

Forks: 14

Open issues: 8

Created: 2019-09-02T08:28:38Z

Pushed: 2026-06-19T05:22:14Z

Default branch: main

Fork: no

Archived: no

README:

PSRule

Validate infrastructure as code (IaC) and DevOps repositories using rules. PSRule allows you to analyze a repository with pre-built rules or create your own. Analysis can be performed from input files or the repository structure.

To learn about PSRule and how to write your own rules see [Getting started][1].

[1]: https://microsoft.github.io/PSRule/v2/quickstart/standalone-rule/

Usage

To get the latest stable release use:

- name: Run PSRule analysis
uses: microsoft/ps-rule@latest

To get the latest stable release by major version use:

- name: Run PSRule analysis
uses: microsoft/ps-rule@v2

To get a specific release use (recommended):

- name: Run PSRule analysis
uses: microsoft/ps-rule@v2.9.0

---

> [!TIP] > The recommended approach is to pin to the latest specific release for example microsoft/ps-rule@v2.9.0. > Pinning to a specific release reduces the risk of new releases breaking your pipeline. > > You can easily update to the latest release by changing the version number or using version updates with Dependabot. > To configure version updates of github-actions with Dependabot see [Configuring version updates][5]. > > When the next release is available, bumping the version allows you to test in a feature branch before merging to main.

---

To get the latest bits use (not recommended for general use or production):

- name: Run PSRule analysis
uses: microsoft/ps-rule@main

---

> [!CAUTION] > Using microsoft/ps-rule@main is not recommended for general use or production workflows. > The main branch is under active development and may be unstable or include breaking changes. > Use microsoft/ps-rule@main to try latest updates before the next stable release and provide feedback.

---

To use the latest action with an older version of PSRule, you can use the version parameter. For example:

- name: Run PSRule analysis
uses: microsoft/ps-rule@v2.9.0
with:
version: '1.11.1'

For a list of changes please see the [change log][2].

[2]: CHANGELOG.md [5]: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates#enabling-dependabot-version-updates

Inputs

- name: Run PSRule analysis
uses: microsoft/ps-rule@main
with:
inputType: repository, inputPath # Optional. Determines the type of input to use for PSRule.
inputPath: string # Optional. The path PSRule will look for files to validate.
modules: string # Optional. A comma separated list of modules to use for analysis.
source: string # Optional. A path containing rules to use for analysis.
baseline: string # Optional. The name of a PSRule baseline to use.
conventions: string # Optional. A comma separated list of conventions to use.
option: string # Optional. The path to an options file.
outcome: Fail, Pass, Error, Processed, Problem, All # Optional. Filters output to include results with the specified outcome.
outputFormat: None, Yaml, Json, NUnit3, Csv, Markdown, Sarif # Optional. The format to use when writing results to disk.
outputPath: string # Optional. The file path to write results to.
path: string # Optional. The working directory PSRule is run from.
prerelease: boolean # Optional. Determine if a pre-release module version is installed.
repository: string # Optional. The name of the PowerShell repository where PSRule modules are installed from.
summary: boolean # Optional. Determines if a job summary is written.
version: string # Optional. The specific version of PSRule to use.

inputType

Determines the type of input to use for PSRule either repository or inputPath. Defaults to repository.

When set to:

• repository - The structure of the repository within inputPath will be analyzed.
• inputPath - Supported file formats within inputPath will be read as objects.

inputPath

The path PSRule will look for input files. You can still use this parameter even when inputType is set to repository.

This must be a relative path from the path input parameter. Defaults to repository root.

Note: Avoid using a relative path starting with /, as a leading slash indicates _root_ on Linux.

modules

A comma separated list of modules to use for analysis.

Modules are additional packages that can be installed from the PowerShell Gallery. PSRule will install the latest stable version from the PowerShell Gallery automatically by default. [Available modules][3].

To install pre-release module versions, use prerelease: true.

[3]: https://www.powershellgallery.com/packages?q=Tags%3A%22PSRule-rules%22

source

An path containing rules to use for analysis. Defaults to .ps-rule/.

Use this option to include rules that have not been packaged as a module.

baseline

The name of a PSRule baseline to use. Baselines can be used from modules or specified in a separate file.

• To use a baseline included in a module use modules: with baseline:.
• To use a baseline specified in a separate file use source: with baseline:.

conventions

A comma separated list of conventions to use. Conventions can be used from modules or specified in a separate file.

• To use a convention included in a module use modules: with conventions:.
• To use a convention specified in a separate file use source: with conventions:.

For example: conventions: Monitor.LogAnalytics.Import

option

The path to an options file. By default, ps-rule.yaml will be used if it exists. Configure this parameter to use a different file.

outcome

Filters output to include results with the specified outcome. Supported outcomes are Fail, Pass, Error, Processed, Problem, All. Defaults to Processed.

outputFormat

The output format to write result to disk. Supported formats are Yaml, Json, NUnit3, Csv, Markdown, Sarif. Defaults to None.

outputPath

The file path to write results to when outputFormat is configured.

path

The working directory PSRule is run from. Defaults to repository root.

Options specified in ps-rule.yaml from this directory will be used unless overridden...