maksemen2/trustmod
Review Go dependency risk in pull requests
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | Command to run: audit, diff, or check | no | diff |
| args | Extra trustmod arguments, parsed with shell-style quoting | no | "" |
| base | Base ref for diff | no | main |
| format | Report format for stdout | no | human |
| policy | Policy file path | no | "" |
| baseline | Baseline file path | no | "" |
| rules | Custom source rules YAML path | no | "" |
| sarif | Optional SARIF output path | no | "" |
| offline | Run in offline mode | no | false |
| govulncheck | Run govulncheck when available | no | false |
| install-govulncheck | Install a pinned govulncheck before running | no | false |
| govulncheck-version | govulncheck module version to install | no | latest |
| concurrency | Maximum concurrency per analysis phase | no | "" |
| timeout | Per-command/provider timeout, such as 30s | no | "" |
| strict-data | Fail when an enabled data provider fails | no | false |
Outputs
| name | description |
|---|---|
| exit-code | Exit code returned by the primary trustmod command |
| sarif-path | SARIF file path written by the optional SARIF step |