pypa/gh-action-pip-audit
Use pip-audit to scan Python dependencies for known vulnerabilities
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 6–8scored Jul 6, 2026
- Maintenance Recency
- Activelast commit Jun 8, 2026
- License
- Apache 2.0
Pinned Snippet
uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| summary | render a Markdown summary of the audit (default true) | no | true |
| no-deps | don't do any dependency resolution (requires fully pinned requirements) (default false) | no | false |
| require-hashes | enforce hashes (requirements-style inputs only) (default false) | no | false |
| vulnerability-service | the vulnerability service to use (PyPI or OSV, defaults to PyPI) | no | PyPI |
| inputs | the inputs to audit, whitespace separated (defaults to current path) | no | "" |
| virtual-environment | the virtual environment to audit within (default none) | no | "" |
| local | for environmental audits, consider only packages marked local (default false) | no | false |
| index-url | the base URL for the PEP 503-compatible package index to use | no | "" |
| extra-index-urls | extra PEP 503-compatible indexes to use, whitespace separated | no | "" |
| ignore-vulns | vulnerabilities to explicitly exclude, if present (whitespace separated) | no | "" |
| disable-pip | disable pip | no | false |
| locked | audit lock files from the local Python project | no | false |
| internal-be-careful-allow-failure | don't fail the job if the audit fails (default false) | no | false |
| internal-be-careful-extra-flags | extra flags to be passed in to pip-audit | no | "" |
Outputs
| name | description |
|---|---|
| internal-be-careful-output | the column-formatted output from pip-audit, wrapped as base64 |