merkuryo/Dependency Security Audit
Audits Python, Node.js, and Go dependencies for known CVEs and blocks merges on critical findings
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| severity_threshold | Minimum severity to report and potentially fail on (LOW, MODERATE, HIGH, CRITICAL) | no | HIGH |
| fail_on_findings | Fail the action if vulnerabilities at or above threshold are found | no | true |
| ecosystems | Comma-separated list of ecosystems to audit (python,node,go) | no | python,node,go |
| python_path | Path to Python project directory (containing requirements.txt or pyproject.toml) | no | . |
| node_path | Path to Node.js project directory (containing package.json) | no | . |
| go_path | Path to Go project directory (containing go.mod) | no | . |
| ignore_cves | Comma-separated list of CVE IDs to ignore (e.g. CVE-2021-1234,CVE-2022-5678) | no | "" |
| post_pr_comment | Post audit results as PR comment | no | true |
Outputs
| name | description |
|---|---|
| total_vulnerabilities | Total number of vulnerabilities found |
| critical_count | Number of CRITICAL vulnerabilities |
| high_count | Number of HIGH vulnerabilities |
| report_json | Path to the full JSON report |