glferreira-devsecops/Cascavel Dependency Audit
Scan project dependencies for known CVEs. Supports npm, pip, Go, Ruby, Rust, PHP, and Java.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Project root to scan for dependency files | no | . |
| severity | Minimum CVE severity to report: low, medium, high, critical | no | medium |
| fail-on-findings | Fail the pipeline if vulnerabilities are found | no | true |
| ecosystems | Comma-separated ecosystems to scan: npm,pip,go,ruby,rust,composer,maven (or "auto") | no | auto |
| ignore-cves | Comma-separated CVE IDs to ignore (e.g., CVE-2024-1234,CVE-2024-5678) | no | "" |
| max-age-days | Only report CVEs published within N days (0 = all) | no | 0 |
| sarif-output | Generate SARIF report for GitHub Security tab | no | true |
Outputs
| name | description |
|---|---|
| total-vulnerabilities | Total number of vulnerabilities found |
| critical-count | Number of critical CVEs |
| high-count | Number of high CVEs |
| affected-packages | Number of affected packages |
| report-path | Path to JSON report |
| sarif-path | Path to SARIF report |