0disoft/Ohrisk
Catch open-source license risk in GitHub Actions.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 12, 2026
- License
- MIT
Pinned Snippet
uses: 0disoft/ohrisk@98eb05382f32375a614a625c1a35ce09654ee364 # v1.2.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Bundled CLI version assertion. Use bundled or the exact CLI version shipped with this action. | no | bundled |
| node-version | Node.js version used by the bundled Ohrisk CLI. | no | 24 |
| setup-node | Boolean string controlling whether actions/setup-node runs. | no | true |
| command | Ohrisk command to run: scan, ci, or diff. | no | ci |
| baseline-ref | Git baseline ref required by command=diff. | no | "" |
| profile | Risk profile: saas or distributed-app. | no | saas |
| prod | Exclude development-only dependencies. | no | true |
| fail-on | Optional high, unknown, review, or low threshold for ohrisk ci or ohrisk diff. The CLI ci default remains high when empty. | no | "" |
| lockfile | Supported repository-relative lockfile path to scan. | no | "" |
| archive | Repository-relative ZIP, TAR, TAR.GZ, or TGZ project archive to scan without extracting it. | no | "" |
| all | Discover and merge every supported lockfile at the selected project root. | no | false |
| policy | Repository-relative Ohrisk policy file path. | no | "" |
| format | Report format: text, json, sarif, markdown, html, or cyclonedx. | no | text |
| output | Repository-relative report output path. | no | "" |
| no-waivers | Ignore local .ohrisk-waivers.json files. | no | false |
| strict-waivers | Fail when local waivers are expired or unmatched. | no | false |
| allow-partial-evidence | Allow command=ci to pass when package evidence or repository coverage is incomplete. | no | false |
| offline | Disable remote evidence requests and use only local evidence or cache entries. | no | false |
| cache | Persist the Ohrisk artifact cache between workflow runs with actions/cache. | no | false |
| cache-dir | Repository-relative persistent artifact cache directory. | no | "" |
| jobs | Evidence collection concurrency from 1 to 64. | no | "" |
| timeout | Per-request timeout such as 30s or 2m. | no | "" |
| registry-url | HTTPS npm-compatible registry URL. | no | "" |
| registry-token-env | Environment variable name containing a bearer token for registry-url. | no | "" |
| allow-hosts | Comma- or newline-separated DNS hostnames explicitly allowed for artifact fetching. | no | "" |
Outputs
| name | description |
|---|---|
| report-path | Report output path when the output input is set. |
| cache-hit | Exact-match result from the persistent artifact cache restore. |