actions-marketplace-validations/safe-pkgs Audit
Audit project dependencies for supply-chain risks using safe-pkgs
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 5, 2026
- License
- MIT
Pinned Snippet
uses: actions-marketplace-validations/math280h_safe-pkgs-action@acc9a104941188967ed9819a220434df64bd47b1 # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to lockfile or project directory | no | . |
| registry | Registry override (npm, cargo, pypi). Auto-detects from lockfile if omitted. | no | — |
| version | safe-pkgs release version to download | no | latest |
| fail-on-severity | Fail the workflow if any package meets this severity (low, medium, high, critical, off) | no | high |
Outputs
| name | description |
|---|---|
| allow | "true" or "false" — overall audit result |
| risk | Highest severity found |
| total | Total packages audited |
| denied | Number of denied packages |
| json | Raw JSON output from safe-pkgs |