1homsi/gorisk
Go dependency risk analyzer — detect risky capabilities and policy violations
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 1, 2026
- License
- MIT
Pinned Snippet
uses: 1homsi/gorisk@2611da7a882d2b2ffe0ca597f2fd7129c6a657e8 # v0.5.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| fail-on | Minimum risk level that causes the action to fail (low|medium|high) | no | high |
| policy-file | Path to a policy JSON file (relative to repo root) | no | "" |
| sarif | Upload SARIF results to the GitHub Security tab | no | true |
| lang | Language analyzer to use (auto|go|node) | no | auto |
| continue-on-error | Continue workflow even if gorisk finds HIGH risk (true|false) | no | false |
| verbose | Enable verbose debug logging from the interprocedural analysis engine | no | false |
Outputs
| name | description |
|---|---|
| passed | true if the scan passed, false otherwise |
| sarif-file | Path to the generated SARIF file |