danielroe/Provenance downgrade check
Fail CI when dependencies in your lockfile lose npm provenance, trusted publisher or staged publishing status.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| lockfile | Path to lockfile (pnpm-lock.yaml, package-lock.json, yarn.lock) | no | — |
| workspace-path | Path to workspace root (default: GITHUB_WORKSPACE) | no | . |
| base-ref | Git ref to compare against (e.g., origin/main) | no | — |
| fail-on-downgrade | Fail behavior: true|false|any|only-provenance-loss (default: true) | no | true |
| fail-on-provenance-change | Fail job when provenance repository/branch changes (default: false) | no | false |
Outputs
| name | description |
|---|---|
| downgraded | JSON array of { name, from, to, downgradeType } for detected downgrades |
| changed | JSON array of provenance change events: { name, from, to, type, previousRepository?, newRepository?, previousBranch?, newBranch? } |