chocksy/DepSec — Supply Chain Security Scanner
Scan for vulnerable dependencies, malicious patterns, hardcoded secrets, and unexpected CI network connections
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | Scan mode: static (default), full (static + network), report (post-install pattern scan + network) | — | static |
| baseline | Path to baseline file, or "auto" to generate on first run | — | "" |
| fail-on | Minimum severity to fail the job: critical, high, medium, low, any | — | any |
| github-token | GitHub token for branch protection check and SHA resolution | — | ${{ github.token }} |
| version | Version of depsec to install (default: latest) | — | latest |
Outputs
| name | description |
|---|---|
| score | Numerical score (0-100) |
| grade | Letter grade (A-F) |
| findings-count | Total number of findings |