conalh/overreach
Scan a pull request diff for code that reaches beyond what it should — network, subprocess, sensitive-file reads, curl|sh, and hardcoded secrets. Requires actions/checkout (fetch-depth: 0) to run first.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| fail-on | Exit non-zero at/above this severity (low|medium|high|critical). Default critical fails only on pipe-to-shell, secrets, and sensitive-file reads; set 'high' to also block new network/subprocess. | no | critical |
| path | Optional path to scan in full-tree mode. If unset, the action scans the PR diff. | no | "" |
Outputs
no outputs