Alcatraz Action flags PII in CI.

A GitHub Action that scans PR diffs, log files and issue text for PII. It runs entirely in the runner: no service, no network calls, no models. 45 entity types across 12 countries, checksum validated.

View on GitHub (opens in a new tab)Get started free
.github/workflows/pii.yml
name: PII scan
on: pull_request

permissions:
  contents: read
  pull-requests: write   # for the report comment

jobs:
  diff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hoophq/alcatraz-action@v1

Flagged in the wild.

A webhook step logs a response body with a card, an email and a CPF in it. The action flags all three, scores them and reports them masked.

workflow-run.log
##[debug]Evaluating condition for step: 'Notify webhook'
##[debug]Response body: {"customer":"Jane Doe","card":"4532 0151 1283 0366","email":"jane.doe@example.com"}
##[debug]cpf=536.904.399-06
##[debug]Step result: success

Alcatraz PII scan

3 findings · values masked · check fails

  • CREDIT_CARD1.00

    45***************66 · Luhn checksum

  • CPF1.00

    53**********06 · Checksum validation

  • EMAIL_ADDRESS0.85

    ja****************om · Pattern, lifted by the word “email”

The same report lands as inline annotations, a sticky PR comment and the job’s step summary.

One step in any job.

The diff comes from the GitHub API, so no fetch-depth: 0. The comment mode needs no checkout at all.

  1. Drop it into your workflow

    One step in any job. Scans PR diffs by default; point it at log files or issue and comment text with mode.

    uses: hoophq/alcatraz-action@v1

  2. Alcatraz scans the run

    Pattern recognizers plus checksum validation, locally in the runner. Powered by Alcatraz, the hoop.labs PII detection library.

    mode: diff | files | comment

  3. Flagged findings, masked

    Inline annotations, a sticky PR comment with masked values and a step summary. The check fails until findings are removed or allow-listed.

    fail-on-findings: true

Built for regulated pipelines.

Every input has a default. Tune the threshold for precision or recall, or allow-list the fixtures your tests seed.

  • Three scan modes

    PR diffs, arbitrary files, and issue or comment text. Capture your test output to a log file and scan it for leaked PII in the same job.

  • No external API

    Runs on Alcatraz locally in the runner. No service, no network calls, no models, and nothing sent to a third-party PII detection service.

  • Compliance-ready

    Findings are reported with masked values, never re-published. Built for teams accountable to SOC 2, HIPAA and PCI audits of their CI/CD pipeline.

modediff

diff scans the lines a PR adds, files scans the paths in paths, comment scans the triggering comment or issue body.

pathsnone

Space-separated files or globs. Required for mode: files.

threshold0.8

Minimum confidence in [0,1]. The default keeps checksum-verified identifiers, which score 1.0, and drops shape-only matches.

entitiesall 45

Comma-separated entity types to restrict to, for example CREDIT_CARD,EMAIL_ADDRESS,US_SSN.

ignore-entitiesDATE_TIME,URL

Entity types dropped as noise.

context-scoringtrue

Scores a match higher when a word naming its entity type precedes it. false scores on pattern strength alone.

allowlist-filenone

A repo path with allowed values, one per line, # comments allowed. For fixtures and seeded demo data.

excludego.sum, *.lock, …

Glob patterns of diff paths to skip in mode: diff. Also *.svg, *.min.js, vendor/** and node_modules/**.

commenttrue

Post or update the sticky report comment.

fail-on-findingstrue

Fail the check when PII is found.

More from hoop Labs.

Each tool solves one problem, runs locally and needs no signup to try.

See every labs tool

Mask PII past the pipeline.

hoop masks sensitive data across every protocol it proxies, databases, shells and cloud consoles, with the same verified detection built into Alcatraz.

Get started freeView on GitHub (opens in a new tab)

Ask an assistant what hoop.dev does: Claude, ChatGPT, Grok, Gemini, Perplexity, Copilot.

the one line
# in any job’s steps
- uses: hoophq/alcatraz-action@v1