kayhanb21/riskratchet

Score per-function risk, ratchet against a baseline, post a sticky PR review comment.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 4, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: kayhanb21/riskratchet@d6e1cf1867b173fd45811207ac5ca483898cac4c # v0.2.14

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
paths	Files or directories to scan, space-separated. Defaults to [tool.riskratchet] paths.	no	""
coverage	Path to coverage.json. Optional; auto-coverage runs if absent.	no	""
baseline	Path to baseline JSON. Default `.riskratchet.json`; if the file is missing, the action runs in no-baseline `--fail-above` mode.	no	.riskratchet.json
fail-above	Threshold for no-baseline mode (when `baseline` file does not exist). Default 60.	no	60
comment	Post a sticky PR review comment. Default `true`. Set `false` for status-check-only mode.	no	true
python-version	Python version to install. Default 3.12.	no	3.12
riskratchet-version	Pin a riskratchet version (e.g. 0.2.8). Default: latest from PyPI.	no	""
local-wheel	Glob for a local wheel to install instead of fetching from PyPI. Used by the repository's own dogfood workflow to test action.yml against an unreleased build. Leave empty in normal use.	no	""
github-token	Token used to upsert the PR comment. Falls back to the workflow github.token when empty.	no	""

Outputs

no outputs