adriandeutsch/DepRadar dependency-health gate

Scan NuGet, npm, PyPI, Cargo or Go dependencies for security, license and maintenance risk, and fail the build on policy violations.

Trust Signals

name	description	required	default
target	What to scan. NuGet: a package id, .csproj or packages.lock.json. npm: a package name, package.json or package-lock.json. PyPI: a package name, requirements.txt, poetry.lock or uv.lock. Cargo: a crate name, Cargo.toml or Cargo.lock. Go: a module path, go.mod or go.sum.	yes	—
ecosystem	The package ecosystem of the target: nuget, npm, pypi, cargo, or go.	no	nuget
fail-on	Fail when any package is at or above this level: none, low, medium, high, critical.	no	high
no-deprecated	Fail the build if any package is deprecated (nuget only).	no	false
forbid	Comma-separated license categories to forbid: permissive, weakcopyleft, copyleft, unknown (nuget only).	no	""
sbom	Optional path to also write a CycloneDX SBOM.	no	""
sarif	Optional path to also write a SARIF report (upload it with github/codeql-action/upload-sarif).	no	""
dotnet-version	The .NET SDK version used to install and run the tool.	no	10.0.x
tool-version	The DepRadar.Tool version to install.	no	0.9.0
tool-source	Extra NuGet source for the tool (e.g. a locally-packed nupkg directory). Defaults to NuGet.org.	no	""

no outputs