peakford/Python security scan (reachability-filtered pip-audit)
Run pip-audit against a uv-managed Python project, then use pi (pi-coding-agent) + an OpenRouter LLM to filter the findings down to vulnerabilities that are actually reachable from this project's declared entry points. Diffs against a cached state file so only newly-introduced reachable CVEs are surfaced. Python-specific: requires a pyproject.toml at the project root (the repo root, or `working-directory` for monorepos), scans the resolved Python dependency graph, and the reachability prompt assumes Python module/import semantics.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 22, 2026
- License
- MIT
Pinned Snippet
uses: peakford/python-security-scan@f89f5018e813083882b4dc24b8ae6e971466b3e8 # v1.2.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| project-name | Project identifier. Used as the state filename (`<project>.json`) and as the default Pushover notification title prefix. Casing is preserved verbatim, so pass `MyProject` rather than `myproject` if you want that. | yes | — |
| entry-points | Multi-line text injected into the pi reachability prompt under "Entry points to consider". Describe how this project's code is actually invoked (HTTP handlers, task queues, CLI entry points, import-time module code, etc.). Required — no default, since defaults tend to bleed stale framework assumptions across projects. | yes | — |
| model | OpenRouter model id, passed to pi as `--provider openrouter --model <id>`. | no | z-ai/glm-5.1 |
| notify | Whether to deliver a Pushover alert when a new reachable CVE is found. Requires PUSHOVER_USER_KEY + PUSHOVER_APP_KEY env in the calling job. | no | true |
| notification-title | Pushover notification title. Defaults to `<project-name>: new reachable CVE` when empty. | no | "" |
| state-key-file | File whose hash is used as the cache key for the persisted scan state (so a lockfile change invalidates and forces re-scoring of every vuln). Resolved relative to `working-directory`. | no | uv.lock |
| working-directory | Subdirectory containing the Python project to scan (its pyproject.toml and lockfile), relative to the repository root. Set this for monorepos; defaults to the repo root. Both pip-audit and the reachability scan are scoped to this directory. | no | . |
| python-script-args | Escape hatch for extra CLI flags forwarded to security_scan_ci.py. | no | "" |
Outputs
no outputs