actions-marketplace-validations/VICE Security Audit
Audit your project for security vulnerabilities. Posts findings on PRs and maintains a security badge in your repo.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Project path to audit (default: repo root) | no | . |
| min-score | Minimum score required to pass (0-100) | no | 70 |
| fail-on-score | Fail the workflow if score is below min-score | no | true |
| comment-pr | Post a comment on pull requests with the scan results | no | true |
| update-badge | Update the security badge file on push events | no | true |
| badge-path | Path to the badge JSON file (relative to repo root) | no | .github/vice-badge.json |
| upload-sarif | Upload SARIF report to GitHub Code Scanning (Security tab). Requires security-events: write permission. | no | true |
| github-token | GitHub token used for posting PR comments and committing the badge | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| score | Security score from 0 to 100 |
| grade | Security grade from A to F |
| total-findings | Total number of findings |
| critical-findings | Number of critical findings |
| high-findings | Number of high severity findings |
| report-path | Absolute path to the JSON report file produced by the scan |