blackoutsecure/Blackout Secure Marketplace Kit

Pre-publish validator for GitHub Marketplace Actions. Lints metadata, branding, naming, and security defaults.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 8, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: blackoutsecure/bos-marketplace-kit@33472b3595a0381843093da9f6640c1b7a5a303a # v0.1.9

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
action_yml_path	Path to the action manifest. Default `action.yml`.	no	action.yml
fail_on_warning	`true` to treat OP### warnings as failures.	no	false
skip_checks	Comma-separated check IDs to skip (e.g. `OP003,SC002`).	no	""
workflow_dir	Workflow directory to scan. Set "" to skip.	no	.github/workflows
github_token	Token used for org-health API lookups. Defaults to `github.token`; set explicitly to use a PAT/fine-grained token with cross-repo contents:read.	no	${{ github.token }}
org_health_repo	`owner/repo` containing fallback community-health files (e.g. `blackoutsecure/.github`). Defaults to `${owner}/.github` if empty.	no	""
check_org_health	`true` to enable org-health lookups for CH### rules.	no	true
require_security	CH001 severity: 'fail', 'warn', or 'skip'.	no	warn
require_code_of_conduct	CH002 severity: 'fail', 'warn', or 'skip'.	no	warn
require_contributing	CH003 severity: 'fail', 'warn', or 'skip'.	no	warn
require_support	CH004 severity: 'fail', 'warn', or 'skip'.	no	skip
require_issue_templates	CH005 severity: 'fail', 'warn', or 'skip'.	no	skip
require_pr_template	CH006 severity: 'fail', 'warn', or 'skip'.	no	skip
require_funding	CH### funding severity: 'fail', 'warn', or 'skip'.	no	skip
community_health_source	Global source mode: 'local', 'inherit', or 'either'.	no	either
security_source	SC003 source override (or empty to use global).	no	""
code_of_conduct_source	CH001 source override (or empty to use global).	no	""
contributing_source	CH002 source override (or empty to use global).	no	""
support_source	CH003 source override (or empty to use global).	no	""
issue_templates_source	CH004 source override (or empty to use global).	no	""
pr_template_source	CH005 source override (or empty to use global).	no	""
funding_source	CH006 source override (or empty to use global).	no	""
auto_generate_missing	[FUTURE] When `true`, use an LLM to draft missing community-health files and open a PR. Stub today; reserved for a future release.	no	false
require_dependabot	DP001 severity: 'fail', 'warn', or 'skip'.	no	warn
require_codeql	CQ001 severity: 'fail', 'warn', or 'skip'.	no	warn
require_editorconfig	LT001 severity: 'fail', 'warn', or 'skip'.	no	warn
require_gitattributes	LT002 severity: 'fail', 'warn', or 'skip'.	no	warn
require_gitignore	LT003 severity: 'fail', 'warn', or 'skip'.	no	warn
require_markdownlint	LT004 severity: 'fail', 'warn', or 'skip'.	no	skip
require_yamllint	LT005 severity: 'fail', 'warn', or 'skip'.	no	skip
require_ghas_code_scanning	GH001 severity: 'fail', 'warn', or 'skip'.	no	warn
require_ghas_secret_scanning	GH002 severity: 'fail', 'warn', or 'skip'.	no	warn
require_dependabot_alerts	GH003 severity: 'fail', 'warn', or 'skip'.	no	warn
require_security_devops	MS001 severity: 'fail', 'warn', or 'skip'.	no	skip
require_scorecard	SR001 severity: 'fail', 'warn', or 'skip'.	no	skip
require_repo_description	RM001/RM002 severity (repo About-box description): 'fail', 'warn', or 'skip'.	no	warn
require_repo_homepage	RM003 severity (repo About-box homepage URL): 'fail', 'warn', or 'skip'. Malformed URLs always fail.	no	skip
require_repo_topics	RM004/RM005 severity (repo About-box topics): 'fail', 'warn', or 'skip'. Format violations and >20 topics always fail.	no	warn
repo_description_max_length	Hard upper bound for the repo description (RM002). Default 350 (GitHub limit).	no	350
repo_description_min_length	Lower bound below which the repo description triggers a warning (RM002). Default 30. Set 0 to disable.	no	30

Outputs

name	description
passed	Number of checks that passed.
failed	Number of checks that failed.
warnings	Number of warnings.
report	Newline-separated `id\|status\|message` rows.