barestripehq/primer
Scan manifests for vulnerabilities with primer before they hit your project
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| file | Manifest or lockfile to scan (e.g. requirements.txt, package-lock.json) | yes | — |
| threshold | Minimum severity that blocks the check: critical, high, medium, low | no | high |
| upload-sarif | Upload SARIF results to GitHub Security tab | no | true |
| comment-pr | Post a findings summary as a PR comment (pull_request events only) | no | true |
| fail-on-findings | Exit 1 when blocking findings are detected | no | true |
| primer-version | Pin a specific primer release tag (e.g. v0.1.5). Defaults to latest. | no | latest |
| token | GitHub token used for SARIF upload and PR comments | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| findings-count | Total number of vulnerabilities found across all packages |
| blocking-count | Number of findings at or above the threshold |
| sarif-path | Path to the generated SARIF file |