devalkotak/Reachability CVE Triage

Rank Python dependency advisories by static reachability and emit JSON/SARIF reports.

Trust Signals

name	description	required	default
project	Python project directory to analyze.	no	.
requirements	Requirements file path relative to the project directory.	no	requirements.txt
json-output	Path for the JSON report.	no	reachability-cve-triage.json
sarif-output	Path for the SARIF report.	no	reachability-cve-triage.sarif
vulnerability-fixture	Optional local advisory fixture path for reproducible scans.	no	""
kev	Fetch live CISA KEV data.	no	false
kev-url	CISA KEV JSON URL used when kev is true.	no	https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
kev-fixture	Optional local CISA KEV fixture path.	no	""
generated-at	Optional fixed timestamp for reproducible reports.	no	""

no outputs