actions-marketplace-validations/npm-audit

Action to run npm audit, and create pull request with fixes

Trust Signals

workflow.ymlSHA-pinned

uses: actions-marketplace-validations/luisfontes19_npm-audit-action@447e4d42dd060e6138eccbe55dc43b67f6424100 # no releases — HEAD as of 2026-07-12

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
github-token	Github Token to create the pull requests	yes	""
only	[NPM PARAM] Specify if only wants to fix 'dev' or 'prod' issues. If not specify will use all	no	""
level	[NPM PARAM] Audit level. Allowed values are: low\|moderate\|high\|critical.	no	""
fix	[NPM PARAM] Use this parameter if you want to automate a fix for the found issues	no	false
package-lock-only	[NPM PARAM]	no	false
force	[NPM PARAM] Force the fixes even if they can create issues	no	false
json	[NPM PARAM] JSON output	no	false
git-user	Git user config to commit the changes of a fix	no	action-npm-audit
git-email	Git email config to commit the changes of a fix	no	action-npm-audit
git-message	Git commit message	no	npm fix run from npm-audit action
git-pr-title	Git Pull Request Title	no	[SECURITY] NPM audit fix
git-branch	Git branch to where commit the fixes	no	npm-audit-action
git-remote	Git remote name to where create the PR	no	origin
project-path	The path to the npm project	no	.

no outputs