oss-wishlist/OSS Wishlist Analyzer
Analyze your project dependencies across all ecosystems (npm, PyPI, Cargo, Maven, etc.) using SBOM and ecosyste.ms data to identify sustainability risks
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Nov 6, 2025
- License
- MIT
Pinned Snippet
uses: oss-wishlist/oss-wishlist-dependency-report@2f7d7b16c61aed74a7162837a5aada5d5b9e3a87 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| sbom-path | Path to SBOM file (SPDX JSON or CycloneDX JSON format) | no | sbom.json |
| token | GitHub token for API access and commenting | yes | ${{ github.token }} |
| dependency-threshold | [DEPRECATED] This input is no longer used for filtering. All dependencies with wishlists are reported. | no | 1000 |
| create-issue | Create GitHub issue for high-risk dependencies | no | false |
| comment-pr | Comment on PR with analysis results | no | true |
| use-wishlists-json | Use a local wishlists JSON file as the primary wishlist filter (overrides funding signals) | no | false |
| wishlists-path | Path to local wishlists JSON file | no | wishlists.json |
| wishlist-map-path | Path to a JSON file that lists packages with wishlists (temporary stand-in until ecosyste.ms exposes an official field) | no | "" |
| filter-scorecard | Filter results by OpenSSF Scorecard overall score range | no | false |
| scorecard-min | Minimum OpenSSF Scorecard score (0.0 - 10.0) | no | 7.0 |
| scorecard-max | Maximum OpenSSF Scorecard score (0.0 - 10.0) | no | 10.0 |
| filter-criticality | Filter results by OpenSSF Criticality score range (requires metric availability) | no | false |
| criticality-min | Minimum OpenSSF Criticality score (0.0 - 1.0) | no | 0.70 |
| criticality-max | Maximum OpenSSF Criticality score (0.0 - 1.0) | no | 1.0 |
| include-bigtech-backed | Include dependencies with Big Tech backing (opt-in). If false, only show packages without Big Tech backing. | no | false |
| mock-wishlists-path | Path to a JSON file that mimics ecosyste.ms wishlists. Relative to workspace. If provided, entries in this file will be treated as having wishlists. | no | "" |
Outputs
| name | description |
|---|---|
| with-wishlist-count | Number of dependencies with wishlists (currently GitHub Sponsors) |
| without-backing-count | Number of dependencies with wishlists but without maintainers using Big Tech email aliases |
| report-path | Path to detailed analysis report |