gorira-tatsu/aminet Supply Chain Review
Analyze dependency changes in pull requests for security, license, and vulnerability issues
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to the manifest to review. Supports package.json, requirements.txt, and pyproject.toml. | — | package.json |
| comment-id | Stable identifier used to match and update the PR comment for this manifest (defaults to the manifest path) | no | — |
| comment-prefix | Display label shown in the PR comment title (defaults to the manifest path) | no | — |
| depth | Maximum dependency depth | no | — |
| deny-license | Comma-separated list of SPDX IDs to deny | no | — |
| fail-on-vuln | Exit non-zero on vulnerabilities at or above severity | no | — |
| security | Enable security deep analysis | — | true |
| lockfile-path | Explicit lockfile path used to pin review resolution (monorepos, or poetry.lock / pdm.lock / uv.lock alongside pyproject.toml) | no | — |
| dev | Include devDependencies in review (default: true) | — | true |
| exclude-packages | Comma-separated packages to skip intentionally (supports wildcards, e.g., @scope/*) | no | — |
| npm-token | npm auth token for private registries when private packages should be analyzed | no | — |
| version | Published aminet version to execute. If omitted, release-tag usage resolves from GITHUB_ACTION_REF; repo-local usage falls back to dist/index.js when available. | no | — |
Outputs
no outputs