The core repository is a GitHub Action. It installs pain001 from the tag you pin, checks the files, uploads the findings to code scanning as SARIF, and fails the job when a file does not pass.
permissions:
contents: read
security-events: write # for the SARIF upload
steps:
- uses: actions/checkout@<sha>
- uses: sebastienrousseau/pain001@v0.0.85
with:
files: "payments/**/*.xml"
scheme: sepa-sct
Pin actions/checkout to a full commit SHA.
Inputs#
| Input | What it does | Default |
|---|---|---|
files | Files or globs to check, separated by spaces or newlines (** recurses). Required. | |
scheme | Scheme profiles to apply, comma-separated, for example sepa-sct. | none |
schematron | A Schematron rulebook: a preset (sepa, fednow, cbpr) or a .sch path. | none |
rules | Path of a private YAML CEL policy file (installs pain001[rules]). | none |
skip-other-xml | Skip XML files that are not pain.001 or pain.008. | "true" |
sarif-file | Where to write the SARIF log. | pain001-check.sarif |
upload-sarif | Upload the SARIF log to code scanning. | "true" |
python-version | The Python to run pain001 on (3.11 or newer). | "3.12" |
The action's exit-code output is 0 when every file passed, 1 on an error finding, and 2 when a file could not be checked.
For your bank's own rules, see build your own bank profile.