pkgradar/PkgRadar Gate

Block CI when an npm, PyPI, RubyGems, Cargo, Maven, NuGet, or Composer dependency upgrade matches PkgRadar's static evidence thresholds. Recursively discovers EVERY supported lockfile in the repo (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, Pipfile.lock, poetry.lock, uv.lock, pdm.lock, Gemfile.lock, Cargo.lock, pom.xml, packages.lock.json, packages.config, project.assets.json, composer.lock) — so a polyglot or monorepo is fully covered without listing each path. Errors if none found.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 26, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: pkgradar/pkgradar-cli@08745a6d8de58795594ff5876f54abd14cecb046 # v0.11.6

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
token	PkgRadar API token (mint at https://pkgradar.com/dashboard/keys).	yes	—
lockfile	Optional explicit lockfile path(s). Leave UNSET to recursively discover and gate every supported lockfile in the repo (the recommended default — covers polyglot/monorepo layouts automatically). To pin specific files, pass one or more paths separated by spaces or newlines, e.g. "frontend/package-lock.json api/requirements.txt".	no	—
fail-on	Block when a spec's risk is at or above this level (low \| review \| high).	no	high
fail-on-cve	Also block on known-vulnerability advisories (plain CVEs) at or above this severity (low \| moderate \| high \| critical). Off by default — advisories are shown as warnings but don't block. Leave UNSET to keep them informational.	no	""
config	Path to a .pkgradar.yml config file (default `.pkgradar.yml`).	no	—
fail-open	Pass the build when the PkgRadar API is unreachable. Set `false` to harden — recommended for security-critical pipelines once your gate cadence is stable.	no	true
version	pkgradar CLI version to install (e.g. v0.1.0). Defaults to latest release.	no	latest
base-url	Override the PkgRadar API base URL (only for self-hosted setups).	no	—
baseline	Git ref to diff against — gate only dependencies ADDED or version-bumped vs this ref, instead of the whole lockfile. Leave UNSET to auto-use the PR merge-base on pull_request events (absolute gating otherwise). For accurate diffs, the caller's checkout should use fetch-depth: 0.	no	""

Outputs

no outputs