joshwani/ZT-Slop PR Guard
Deterministic PR check for supply-chain threats in dependency, lockfile, workflow, and secret-related changes.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| base-ref | Base git ref or SHA. Defaults to the pull request base SHA, then HEAD~1. | no | "" |
| head-ref | Head git ref or SHA. Defaults to github.sha, then HEAD. | no | "" |
| config | Optional JSON config path. | no | zt-slop.json |
| fail-on | Exit non-zero on block, warn, or none. | no | block |
| no-network | Disable OSV network lookups. | no | false |
| json-report | JSON report path. | no | zt-slop-report.json |
| markdown-report | Markdown report path. | no | zt-slop-report.md |
| sarif-report | SARIF report path. | no | zt-slop-report.sarif |
Outputs
| name | description |
|---|---|
| report-json | Path to the JSON report. |
| report-markdown | Path to the Markdown report. |
| report-sarif | Path to the SARIF report. |