developmentseed/Security Scan
Org-wide composite security scanning: zizmor (workflow linter), osv-scanner (dependency vulnerabilities), optional Python audit (bandit + pip-audit), and optional OSSF Scorecard. Adopt with a single `uses:` line.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| enable_zizmor | Run zizmor GitHub Actions workflow linter (opt-out with 'false') | — | true |
| enable_osv | Run osv-scanner dependency vulnerability scanner (opt-out with 'false') | — | true |
| enable_python_audit | Run bandit + pip-audit Python security audit (opt-in with 'true') | — | false |
| zizmor_persona | Auditing persona — regular / pedantic / auditor | — | regular |
| zizmor_min_severity | Minimum severity to report — low / medium / high; empty = all | — | "" |
| zizmor_min_confidence | Minimum confidence to report — low / medium / high; empty = all | — | "" |
| zizmor_online_audits | Enable zizmor online audit checks | — | true |
| zizmor_config | Path to custom zizmor configuration file; empty = none | — | "" |
| osv_scan_args | osv-scanner CLI args, one per line | — | --recursive --allow-no-lockfiles ./ |
| osv_fail_on_vuln | Fail the job when osv-scanner finds vulnerabilities | — | true |
| osv_upload_sarif | Upload osv-scanner results to GitHub Code Scanning | — | true |
| osv_results_file_name | SARIF output filename for osv-scanner results | — | results.sarif |
| python_audit_tools | Comma-separated tools to run — bandit, pip-audit | — | bandit,pip-audit |
| python_audit_bandit_scan_dirs | Comma-separated directories for bandit | — | . |
| python_audit_bandit_severity_threshold | Minimum bandit severity that blocks — high / medium / low | — | high |
| python_audit_pip_audit_block_on | When pip-audit blocks — fixable / all / none | — | fixable |
| python_audit_package_manager | Dependency resolution for pip-audit — uv / pip / poetry / pipenv / requirements | — | requirements |
| python_audit_requirements_file | Requirements file path (when package_manager=requirements) | — | requirements.txt |
| python_audit_comment_on | When to post a PR comment — never / blocking / always | — | never |
| python_audit_working_directory | Working directory for python audit | — | . |
| python_audit_debug | Enable debug logging for python audit | — | false |
| enable_scorecard | Run OSSF Scorecard analysis (opt-in with 'true'). Requires id-token:write and actions:read permissions on the calling job. | — | false |
| scorecard_publish_results | Publish Scorecard results to the OSSF dashboard. Only effective on default-branch pushes; ignored on PRs. | — | true |
| github_token | GitHub token for SARIF upload and PR comments | — | ${{ github.token }} |
Outputs
no outputs