jverhoeks/Setup Escrow Proxy
Start the escrow supply-chain proxy, restore the package cache, and configure npm / pip / uv / Go / Cargo / NuGet / Maven to route all installs through age-gate and OSV vulnerability policy enforcement.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Escrow release tag to install (e.g. v1.4.0) | no | v1.11.0 |
| port | Port for the escrow proxy | no | 7888 |
| ecosystems | Comma-separated ecosystems to enable: npm,pypi,go,cargo,nuget,maven,composer | no | npm,pypi,go,cargo |
| min-days | Age gate — block packages published fewer than N days ago | no | 7 |
| osv-severity | Block packages with OSV vulnerabilities at this severity or above (LOW|MEDIUM|HIGH|CRITICAL|off) | no | HIGH |
| cache-key-suffix | Extra string appended to the cache key for manual busting | no | "" |
Outputs
| name | description |
|---|---|
| proxy-url | Escrow proxy base URL (e.g. http://127.0.0.1:7888) |
| renovate-config | Renovate JSON config fragment routing cargo/maven/nuget/composer datasource lookups through escrow. Renovate auto-detects npm/PyPI/Go via the env vars already exported — only these four need explicit config. Pass as RENOVATE_CONFIG env var to renovatebot/github-action. |