gitrdunhq/Dependency Review
Evaluate dependency changes for security, license, and policy compliance
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| operating-mode | monitor (log only) or advise (PR comment + build warning) | no | monitor |
| team | Team name for the request | no | ${{ github.repository_owner }} |
| enabled-scanners | Comma-separated scanner list | no | syft,osv-scanner,trivy,scancode |
| db-dsn | PostgreSQL DSN (optional — runs without DB if omitted) | no | "" |
| evidence-path | Path to store evidence bundles | no | ./evidence |
| policy-path | Path to OPA policy directory | no | ./policies |
Outputs
| name | description |
|---|---|
| decision | Decision verdict (approve/reject/needs_review/approve_with_constraints) |
| memo | Decision memo text |