lucashgrifoni/OSS Security Policy as Code
Evaluate a repository against bundled OSS security baselines (governance, CI/CD, supply chain).
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| target | Path to the repository root to evaluate. Defaults to the workspace. | no | . |
| profile | Profile ID (e.g. github-level-1, github-release-hardening-2) or path to an external YAML profile. Omit to read the profile from oss-policy-kit.yaml at the target. | no | "" |
| fail-on | CI gate mode: none, fail, or degraded. Defaults to fail. | no | fail |
| output-dir | Directory where evaluation-report.json / .md will be written. | no | oss-policy-reports |
| waivers | Optional path to a waivers YAML file (kept under version control). | no | "" |
| scorecard-json | Optional OpenSSF Scorecard JSON export used as supplemental evidence. | no | "" |
| sarif-output | Optional SARIF 2.1.0 file path (relative paths resolve under output-dir). When set, the action emits SARIF; uploading it to Code Scanning is the caller's responsibility (e.g. via github/codeql-action/upload-sarif). | no | "" |
| kit-version | Pin a specific oss-policy-kit version on PyPI. Defaults to the version that matches this action tag. Use `latest` to track the newest 5.x. | no | "" |
| python-version | Python version used to run the kit. 3.12+ is required. | no | 3.12 |
Outputs
| name | description |
|---|---|
| report-json | Absolute path to evaluation-report.json |
| report-markdown | Absolute path to evaluation-report.md |
| sarif | Absolute path to the SARIF file (only set when sarif-output was provided). |
| exit-code | Exit code returned by `oss-policy-kit evaluate` (0 / 1 / 2 / 3). |