am6539/Setup PMG
Install Package Manager Guard (PMG) and wrap npm/pip/etc. in this Linux GitHub Actions runner.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 8, 2026
- License
- Apache 2.0
Pinned Snippet
uses: am6539/pmg@35e69b217a599dbf8611a130d0b45043d8744c6f # v0.21.6tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| version | PMG release tag to install (e.g. v0.42.0) or "latest". | no | latest |
| api-key | SafeDep Cloud API key. When set together with tenant-id, cloud sync is enabled and credentials are passed via env (no keychain needed in CI). | no | "" |
| tenant-id | SafeDep Cloud tenant ID. Required when api-key is set. | no | "" |
| endpoint-id | Identifier reported to SafeDep Cloud for this runner. When empty and cloud is enabled, defaults to "github-actions/<owner>/<repo>" so events aggregate per repository instead of per ephemeral runner hostname. | no | "" |
| paranoid | Treat suspicious packages as malicious (PMG_PARANOID). Empty = use PMG default (false). | no | "" |
| cooldown-enabled | Block recently-published package versions (PMG_DEPENDENCY_COOLDOWN_ENABLED). Empty = use PMG default (true). | no | "" |
| cooldown-days | Cooldown window in days (PMG_DEPENDENCY_COOLDOWN_DAYS). Empty = use PMG default (5). | no | "" |
| proxy-mode | Use proxy-based interception (PMG_PROXY_ENABLED). Empty = use PMG default (true). Setting "false" falls back to guard-based analysis. | no | "" |
| sandbox | Run package managers inside an OS sandbox (PMG_SANDBOX_ENABLED). Empty = use PMG default (false). Enabling will also relax AppArmor user-namespace restrictions on the runner so unprivileged user namespaces work. | no | "" |
| sandbox-driver | Sandbox backend on Linux (PMG_SANDBOX_DRIVER). One of "landlock" or "bubblewrap". Defaults to "landlock" when sandbox is enabled and this is empty. | no | "" |
| verbosity | PMG output verbosity (PMG_VERBOSITY). One of "silent", "normal", "verbose". Empty = use PMG default. | no | "" |
| disable-telemetry | Disable anonymous PMG telemetry (PMG_DISABLE_TELEMETRY). Empty = use PMG default. | no | "" |
| skip-event-logging | Skip writing audit events to the local event log (PMG_SKIP_EVENT_LOGGING). Empty = use PMG default. | no | "" |
| config-file | Path (relative to the workspace) to a user-supplied PMG config.yml. Copied into the PMG config directory before "pmg setup install" runs, so PMG merges any missing template keys into it. | no | "" |
| cache | Reuse a previously-installed PMG binary from $RUNNER_TOOL_CACHE/pmg/<version>/<arch>. Off by default; fresh download per run keeps the binary current and reduces the blast radius of any cached artifact tampering. Checksum verification still runs on every install path. | no | false |
Outputs
| name | description |
|---|---|
| version | The resolved PMG version that was installed. |
| bin-dir | Directory containing the pmg binary on this runner. |