manfred-kaiser/requirements-check

Check a requirements.txt (or CycloneDX SBOM) for outdated dependencies and known vulnerabilities.

Trust Signals

name	description	required	default
file	Path to the requirements.txt (or CycloneDX SBOM) to check.	no	requirements.txt
format	Output format: table, json, sbom, html, or sarif.	no	sarif
output	Path to write the report to.	no	requirements-check-report
fail-on-vulnerability	Fail the step if any known vulnerability is found (checked after the SARIF upload, so findings still show up in the Security tab even when this fails the job).	no	false
no-security	Skip the OSV.dev vulnerability check.	no	false
no-transitive-check	Skip the transitive-dependency coverage warning.	no	false
constraints	Path to a loose, unresolved requirements file (e.g. a pip-compile .in source) to cross-check suggestions against.	no	""
target-python-version	Target Python version (e.g. 3.11) for requires-python compatibility filtering. Defaults to setup-python-version.	no	""
proxy	HTTP(S) proxy URL for PyPI/OSV requests.	no	""
ca-bundle	Path to a custom CA bundle file for TLS verification.	no	""
requirements-check-version	Version of the requirements-check PyPI package to install. Defaults to the latest release.	no	""
setup-python-version	Python version used to run requirements-check itself.	no	3.13
upload-sarif	Automatically upload the report to GitHub code scanning. Only applies when format is sarif.	no	true

name	description
report-path	Path to the generated report file.
exit-code	requirements-check's own exit code (0 success, 1 vulnerabilities found, 2 usage error).