arnica-io/Arnica Dependency Security Scan

Scan a repository for dependencies and vulnerabilities

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit May 18, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: arnica-io/dependency-scan@6b1377a3d111170de80632696039f658f59940e1 # v1.0.31

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
repository-url	Repository URL associated with the scan	yes	—
branch	Branch name associated with the scan	yes	main
scan-path	Repository path to associate with the scan	no	.
api-base-url	Arnica API base URL (e.g., https://api.app.arnica.io)	no	https://api.app.arnica.io
scan-timeout-seconds	Maximum time to wait for scan completion in seconds	no	900
api-token	Arnica API token (prefer passing via secrets)	no	—
on-findings	Behavior when findings are detected (Failure). One of fail\|alert\|pass	no	fail
debug	Enable verbose API response debug logs	no	false

Outputs

name	description
scan-id	Arnica scan identifier.
status	Final scan status (Success, Failure, Error, Skipped, Timeout)