1homsi/gorisk

Go dependency risk analyzer — detect risky capabilities and policy violations

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit Apr 1, 2026
License
MIT

Pinned Snippet

workflow.ymlSHA-pinned
uses: 1homsi/gorisk@2611da7a882d2b2ffe0ca597f2fd7129c6a657e8 # v0.5.0

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
fail-onMinimum risk level that causes the action to fail (low|medium|high)nohigh
policy-filePath to a policy JSON file (relative to repo root)no""
sarifUpload SARIF results to the GitHub Security tabnotrue
langLanguage analyzer to use (auto|go|node)noauto
continue-on-errorContinue workflow even if gorisk finds HIGH risk (true|false)nofalse
verboseEnable verbose debug logging from the interprocedural analysis enginenofalse
namedescription
passedtrue if the scan passed, false otherwise
sarif-filePath to the generated SARIF file