jordanconway/Package Manager Hardening Audit
Audit package manager security configuration — lockfiles, exact version pinning, minimum release age, Dependabot cooldowns, Harden-Runner coverage — and fail the job with remediation hints when hardening gaps are found.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to the repository root to audit (relative to the workspace). | no | . |
| warn-only | Set to "true" to publish the report without failing the job on findings. | no | false |
| cooldown-strategy | How to grade the release-age cooldown control. "auto" (default): satisfied by either a resolver-level cooldown (uv exclude-newer, npm/pnpm/bun/yarn age gates, cargo-cooldown) or a Dependabot cooldown, and warns when both are configured (the resolver-level one blocks Dependabot's automated security updates). "dependabot": require a Dependabot cooldown and flag redundant resolver-level cooldowns — recommended for org estates standardised on Dependabot. "resolver": require a resolver-level cooldown. | no | auto |
Outputs
| name | description |
|---|---|
| json-path | Absolute path to the raw audit findings JSON (in the runner temp directory). |
| report-path | Absolute path to the rendered markdown report (in the runner temp directory). |