lachaib/lockscan
Security analysis of lockfile changes — detects supply-chain attacks in dependency updates
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 16, 2026
- License
- None
Pinned Snippet
uses: lachaib/lockscan@ec37126606dde4da7d7971ed4c181492bcbc1e17 # v0.1.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| lockdelta-output | The lockdelta JSON diff report. Accepts a raw JSON string (e.g. from steps.lockdelta.outputs.diff) or a file path written by lockdelta's json-to-file option. | yes | — |
| github-token | GitHub token for the repo release check and PR comment posting. Defaults to the built-in GITHUB_TOKEN. | no | ${{ github.token }} |
| platform | Target platform(s). Format: os/arch[/pyver] (e.g. linux/x86_64/3.12, macos/arm64). Separate multiple platforms with commas or newlines. Defaults to the runner's host platform. | no | — |
| only | Restrict analysis to these change types. Comma-separated: added, updated, removed. Defaults to all three. | no | — |
| markdown | Generate a markdown summary of findings and expose it as the summary output. The GitHub step summary is always written regardless of this flag. | no | false |
| markdown-to-file | Write the markdown summary to this file path. | no | — |
| sarif-to-file | Write a SARIF 2.1.0 report to this file path. Use together with actions/upload-sarif to surface findings in GitHub's Security / Code Scanning tab with inline PR annotations and alert lifecycle. | no | — |
| annotate | Emit GitHub workflow annotations on the dependency manifest file (package.json, pyproject.toml, etc.) for each finding. Annotations appear as inline comments on the PR diff. Set to 'false' to disable. | no | true |
| post-comment | Post or update a single PR comment with the markdown summary. 'true' always posts or updates. 'if-findings' posts when findings exist; updates to a "resolved" message when a subsequent run finds nothing. 'false' never posts. | no | false |
| fail-on | Fail the step when findings at or above this severity are detected. critical — fail on CRITICAL findings only. high — fail on HIGH or CRITICAL. any — fail on any finding. never ��� advisory-only mode; never fails. | no | never |
| write-summary | Write the markdown summary to the GitHub step summary ($GITHUB_STEP_SUMMARY). Set to 'false' to disable. | no | true |
Outputs
| name | description |
|---|---|
| report | The full security report as a JSON string. |
| summary | Markdown summary of findings. Set when markdown: 'true' or when post-comment is enabled. |
| sarif | SARIF 2.1.0 report as a JSON string. Only set when sarif-to-file is specified. |
| has-findings | 'true' if any security findings were identified, 'false' otherwise. Useful for conditional downstream steps. |
| has-critical | 'true' if any CRITICAL severity findings were identified. |
| has-high | 'true' if any HIGH or CRITICAL severity findings were identified. |