cboyd0319/PyGuard Security Scanner
Comprehensive Python security and code quality analysis with auto-fix capabilities.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| paths | Paths to scan (space-separated). Supports files and directories. Example: "src/ app.py lib/" | no | . |
| python-version | Python version to use for scanning. Should match your project version. Supports 3.11, 3.12, 3.13. | no | 3.13 |
| scan-only | Only scan without fixing issues. Recommended for CI/CD to avoid code changes. Set to "false" to enable auto-fix. | no | true |
| security-only | Only run security checks, skipping code quality analysis. Faster scans focused on vulnerabilities. | no | false |
| severity | Minimum severity level to report (LOW, MEDIUM, HIGH, CRITICAL). Higher levels filter out lower severity issues. | no | LOW |
| exclude | File patterns to exclude from scanning (space-separated). Supports glob patterns. Example: "tests/* *.pyc __pycache__/*" | no | tests/* venv/* .venv/* build/* dist/* .git/* .github/* node_modules/* |
| sarif-file | Output SARIF file path for GitHub Code Scanning integration. Must end in .sarif | no | pyguard-report.sarif |
| upload-sarif | Upload SARIF results to GitHub Security tab. Requires security-events: write permission. | no | true |
| fail-on-issues | Fail the workflow if security issues are found. Useful for security gates on pull requests. | no | false |
| unsafe-fixes | Enable unsafe auto-fixes that may change code behavior. WARNING: Only use with scan-only=false. Review changes carefully! | no | false |
Outputs
| name | description |
|---|---|
| issues-found | Number of security issues found |
| sarif-file | Path to generated SARIF report |