ben-ranford/Scan with Lopper
Run Lopper dependency-surface analysis in GitHub Actions.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 12, 2026
- License
- MIT
Pinned Snippet
uses: ben-ranford/lopper@bc52d5718e386309506b2c2e61c2d9279423fdcc # v1.8.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Lopper CLI release to install. Use action to match an action tag when possible, latest for the newest stable release, a floating tag such as v1 or v1.8, or a concrete tag such as v1.8.0. | no | action |
| github-token | Optional token used when resolving and downloading GitHub release assets. | no | "" |
| repo | Repository path to analyse. | no | . |
| mode | Execution mode: analyse, dashboard, or pr-review. dashboard requires action-dashboard-mode-preview; pr-review requires dependency-surface-pr-review-preview. | no | analyse |
| dashboard-config | Dashboard config file path for dashboard mode. | no | "" |
| dashboard-repos | Comma-separated repository paths for dashboard mode. | no | "" |
| dashboard-format | Dashboard output format: json, csv, html, slack-summary, teams-summary, or cyclonedx-json. | no | "" |
| dashboard-output | Dashboard output file path. | no | "" |
| pr-base | Full immutable base commit SHA for pr-review mode. | no | "" |
| pr-head | Full immutable head commit SHA for pr-review mode. | no | "" |
| pr-review-format | PR review output format: markdown or json. | no | markdown |
| pr-review-output | PR review output file path. | no | "" |
| pr-fail-on-regression | Fail pr-review mode when new regression rows are detected. | no | false |
| pr-material-waste-bytes | Estimated unused byte increase required for a material PR regression. | no | 1024 |
| pr-max-rows | Maximum Markdown rows per PR review section. | no | 20 |
| dependency | Optional single dependency target. When set, top is ignored. | no | "" |
| top | Number of top dependencies to analyse when dependency is not set. | no | — |
| language | Language adapter to use, such as auto, all, js-ts, python, go, rust, dotnet, swift, dart, or powershell. Defaults to all for analyse and pr-review, and auto for dashboard. | no | "" |
| scope-mode | Analysis scope mode: repo, package, or changed-packages. | no | — |
| format | Output format: table, csv, json, sarif, pr-comment, or cyclonedx-json. cyclonedx-json requires enable-feature=sbom-attestation-exports-preview. | no | table |
| output | Optional output file path. Use - or leave blank to write to stdout. | no | "" |
| baseline | Baseline JSON report path for comparison. | no | "" |
| baseline-store | Baseline snapshot directory. | no | "" |
| baseline-key | Baseline snapshot key for comparison. | no | "" |
| baseline-label | Label key to use when saving a baseline snapshot. | no | "" |
| save-baseline | Save the current run as an immutable baseline snapshot. | no | false |
| config | Optional Lopper config file path. | no | "" |
| include | Comma-separated include path globs. | no | "" |
| exclude | Comma-separated exclude path globs. | no | "" |
| runtime-profile | Conditional exports runtime profile. | no | node-import |
| runtime-trace | Runtime trace file path. | no | "" |
| runtime-test-command | Optional allowlisted test command to run with runtime tracing, including stable pytest, unittest, and uv runner profiles. | no | "" |
| advisory-source | Local JSON or YAML advisory file to attach vulnerability findings without network access. Requires enable-feature=reachability-vulnerability-prioritization-preview. | no | "" |
| cache | Enable the incremental analysis cache. | no | true |
| cache-path | Optional analysis cache directory path. | no | "" |
| cache-readonly | Read cache entries but do not write misses. | no | false |
| threshold-fail-on-increase | Fail when waste increase is greater than this percent. Use 0 for strict no-regression gating. | no | "" |
| threshold-low-confidence-warning | Warn in all-language mode when adapter confidence is below this percent. | no | "" |
| threshold-min-usage-percent | Minimum used export percent before low-usage recommendations are emitted. | no | "" |
| threshold-max-uncertain-imports | Fail when unresolved dynamic import/require usage count exceeds this threshold. | no | "" |
| threshold-reachable-vulnerability-priority | Fail when reachable local advisory findings meet or exceed this reachability-weighted priority: off, low, medium, high, or critical. Requires enable-feature=reachability-vulnerability-prioritization-preview when above off. | no | "" |
| lockfile-drift-policy | Lockfile drift policy: off, warn, or fail. | no | "" |
| license-deny | Comma-separated denied SPDX identifiers. | no | "" |
| license-fail-on-deny | Fail when denied licenses are detected. | no | false |
| license-provenance-registry | Include registry provenance heuristics for JS/TS dependencies. | no | false |
| enable-feature | Comma-separated feature flag names or codes to enable. | no | "" |
| disable-feature | Comma-separated feature flag names or codes to disable. | no | "" |
Outputs
| name | description |
|---|---|
| report-path | Output report path when the output input points at a file. |
| lopper-version | Installed Lopper version output from lopper --version. |
| resolved-version | Resolved release tag used for the installed Lopper CLI. |
| binary-path | Installed Lopper binary path. |