lfreleng-actions/🛡️ Node.js Dependency Audit
Audits Node.js project dependencies for known vulnerabilities with npm audit
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- None
Pinned Snippet
uses: lfreleng-actions/node-audit-action@bfd96d8e38bf62d8764737fbefbf74f945377afc # v0.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path_prefix | Project directory; must resolve within the workspace | no | . |
| node_version | Node.js version to set up, such as '22', '22.x' or 'lts/*'; characters A-Z a-z 0-9 . * / _ - | no | 22 |
| node_version_file | File containing the Node.js version, such as '.nvmrc'; takes precedence over node_version; must resolve within the workspace | no | "" |
| audit_level | Fail threshold severity: 'info', 'low', 'moderate', 'high' or 'critical' | no | high |
| production_only | Audit production dependencies only ('true'/'false') | no | false |
| permit_fail | Report vulnerabilities at/above the threshold without failing ('true'/'false') | no | false |
| output_directory | JSON report directory, within workspace or runner temp | no | . |
Outputs
| name | description |
|---|---|
| audit_passed | 'true' when no vulnerabilities at/above the threshold were found |
| vulnerability_count | Total vulnerabilities reported across all severities |
| report_path | Path to the JSON audit report |