itsmangooo/Weedout Security Scan

Scan your dependencies for the CVEs that are actually exploited or actually reachable, and fail the build only when something genuinely is.

Trust Signals

name	description	required	default
api-key	A Weedout project API key. Pass it from a secret -- ${{ secrets.WEEDOUT_API_KEY }} -- never inline. The key decides which project the scan belongs to, so there is nothing else to configure.	yes	—
fail-on	The severity floor that fails the build: "critical" (also fails on anything CISA lists as exploited in the wild) or "high". Confirmed exploitation fails at either setting.	no	critical
path	The directory to scan. Defaults to the repository root.	no	.
version	Which CLI release to run, e.g. "v0.1.0". Defaults to the latest release. Pin it if you want the scan to be reproducible.	no	latest
comment-on-pr	On a pull request, post the summary as a comment and update that same comment on later runs. Needs pull-requests:write permission.	no	true
github-token	Token used to post the pull request comment.	no	${{ github.token }}
api-url	The Weedout API base URL. Only useful for self-hosting.	no	https://weedout.dev

name	description
critical-count	Open findings at critical severity.
high-count	Open findings at high severity.
exploited-count	Open findings CISA lists as exploited in the wild.
blocking-count	Findings at or above `fail-on`. This is the number the exit code is about to be decided by.
filtered-count	Advisories that matched your dependencies and were deliberately not reported. Usually an order of magnitude larger than the rest.
findings-url	Link to this project on the Weedout dashboard.
result-json	Path to the full scan result as JSON, for a later step to read.