lfreleng-actions/🐍 Python Dependency Audit
Check Python dependencies for known security vulnerabilities
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 8, 2026
- License
- None
Pinned Snippet
uses: lfreleng-actions/python-audit-action@fcb1b2e0cdbe19edf11057e598138f3d57f2b249 # v0.3.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| python_version | Python version used to perform audit | yes | — |
| artefact_name | Artefact name to download (defaults to project name) | no | — |
| permit_fail | Continue/pass even when the audit fails | no | false |
| artefact_path | Path/location to build artefacts | no | dist |
| summary | Whether to generate summary output | no | true |
| path_prefix | Directory location containing project code | no | "" |
| ignore_vulns | Vulnerability IDs to ignore (whitespace separated). These IDs are merged with any IDs sourced from the allow-list file (see the allow_list_* inputs); duplicates are de-duplicated. | no | GHSA-4xh5-x5gv-qwph |
| allow_list_path | Local filesystem path to a vulnerability allow-list file. When set, takes precedence over allow_list_url and allow_list_org. The path string itself must not contain newline characters; the file it points to may be multi-line. File format: whitespace-separated vulnerability IDs (CVE-, GHSA-, PYSEC-, OSV-, PVE-); '#' introduces a comment (full-line or trailing). | no | "" |
| allow_list_url | Remote HTTPS URL to download the allow-list from. Ignored when allow_list_path is set. When both allow_list_path and allow_list_url are empty the action constructs a default URL from allow_list_org (see below). The URL string itself must not contain newline characters. | no | "" |
| allow_list_org | GitHub organisation/owner used to construct the default allow-list URL when neither allow_list_path nor allow_list_url is supplied. Defaults at runtime to github.repository_owner. Default URL pattern: https://raw.githubusercontent.com/<org>/.github/HEAD/.github/python-audit/<org>/allow_list.txt | no | "" |
| allow_list_disable | When 'true', skip allow-list loading entirely and use only the 'ignore_vulns' input. | no | false |
| config | GitHub-Actions uses-style coordinate identifying a remote allow-list file, fetched with a shallow, ref-pinned git fetch (supports branch, tag or commit SHA). Mutually exclusive with the allow_list_path, allow_list_url, allow_list_org and allow_list_disable inputs; supplying any of them together with 'config' is an error (allow_list_summary is still honoured). See the README for the full grammar. | no | "" |
| token | Token used to authenticate the git fetch when 'config' targets a private host repository. Leave empty for public repositories. GITHUB_TOKEN only grants access to the current repository; reading a private config repo in another org needs a PAT or GitHub App token with contents:read on that repo. | no | "" |
| allow_list_summary | Whether to write the allow-list/config block to the job step summary. Set to 'false' to suppress it. Useful for matrix jobs, where the same block would otherwise repeat once per leg; emit it on a single matrix leg only (see the README for the strategy.job-index pattern). | no | true |
Outputs
| name | description |
|---|---|
| resolved_host_org | Host org the config file was fetched from |
| resolved_repo | Repository the config file was fetched from |
| resolved_ref | Git ref requested for the config fetch |
| resolved_sha | Exact commit SHA the config ref resolved to |
| resolved_path | In-repo path of the matched config file |
| matched_candidate | Search candidate that matched |