millionco/React Doctor

Scan React codebases for security, performance, and correctness issues

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 11, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: millionco/react-doctor@dfccac44e4468dd971e2a4fe8e44a49ba91f498a # deslop-cli@0.7.4

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
directory	Project directory to scan	—	.
project	Workspace project(s) to scan (comma-separated). Use "*" to scan every discovered project.	—	*
scope	On pull requests, what to scan/report (same meanings as the CLI --scope): 'changed' (only issues the PR introduced vs base — the default), 'files' (all issues in changed files), 'lines' (only issues on the changed lines), or 'full' (the entire project, every finding). Non-PR events always scan the full project.	—	changed
blocking	Severity that fails the workflow: none (default; advisory — report findings but always exit 0), warning, or error.	—	none
comment	Create or update a sticky pull request summary comment. Automatically skipped when the pull request changes no React-eligible files (`.tsx`/`.jsx` or framework entry files).	—	true
review-comments	Post inline review comments on the changed lines that triggered diagnostics (pull requests only).	—	true
silence-missing-baseline-warning	By default the PR comment shows a warning when a compare scope (`changed`) can't reach the base branch (e.g. a shallow checkout) and falls back to reporting every issue in the changed files, not only the ones the PR introduced. Set to true to hide that warning (fixing the checkout with `fetch-depth: 0` is the real remedy).	—	false
commit-status	Publish a commit status with the score and error / warning counts, linking to the run. Surfaces the result on pushes to the default branch (where the PR comment is skipped). Reads "Skipped" when the pull request changes no React-eligible files. Requires `statuses: write` (skipped with a warning otherwise).	—	true
node-version	Node.js version to use	—	24
version	react-doctor npm version or package spec to run	—	latest

Outputs

name	description
score	Health score (0-100). Empty when scoring was unavailable.
total-issues	Total diagnostic count in the scan report. In baseline mode (pull requests), this is the count of issues introduced by the PR.
fixed-issues	Baseline mode (pull requests) only: count of issues the PR resolved. 0 otherwise.
error-count	Error diagnostic count in the scan report.
warning-count	Warning diagnostic count in the scan report.
affected-files	Number of files with diagnostics.