kayhanb21/riskratchet
Score per-function risk, ratchet against a baseline, post a sticky PR review comment.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 4, 2026
- License
- MIT
Pinned Snippet
uses: kayhanb21/riskratchet-action@7caf0f2ca40b0b335e6307147a28f19b8bae0501 # v1.0.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| paths | Files or directories to scan, space-separated. Defaults to [tool.riskratchet] paths. | no | "" |
| coverage | Path to coverage.json. Optional; auto-coverage runs if absent. | no | "" |
| baseline | Path to baseline JSON. Default `.riskratchet.json`; if the file is missing, the action runs in no-baseline `--fail-above` mode. | no | .riskratchet.json |
| fail-above | Threshold for no-baseline mode (when `baseline` file does not exist). Default 60. | no | 60 |
| comment | Post a sticky PR review comment. Default `true`. Set `false` for status-check-only mode. | no | true |
| python-version | Python version to install. Default 3.12. | no | 3.12 |
| riskratchet-version | Pin a riskratchet version (e.g. 0.2.12). Default: latest from PyPI. | no | "" |
| github-token | Token used to upsert the PR comment. Falls back to the workflow github.token when empty. | no | "" |
Outputs
no outputs