pyupio/pyupio/safety

Runs the Safety CLI dependency scanner against your project

Trust Signals

Scorecard Score: Scorecard 4–6scored Jul 6, 2026
Maintenance Recency: Activelast commit May 27, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: pyupio/safety@ec3368a4f8239249088b77794d414526112e6aac # 3.8.1

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
api-key	PyUp.io API key	no	""
create-pr	Create a PR if Safety finds any vulnerabilities. Only the `file` scan mode is currently supported - combine with Cron based actions to get automatic notifications of new vulnerabilities.	no	""
create-issue	Create an issue if Safety finds any vulnerabilities. Only the `file` scan mode is currently supported - combine with Cron based actions to get automatic notifications of new vulnerabilities.	no	""
scan	Scan mode to use. One of auto / docker / env / file (defaults to auto)	no	auto
docker-image	Tag or hash of the Docker Image to scan (defaults to autodetecting the last built tagged image)	no	""
requirements	Path of requirements file to scan (defaults to poetry.lock -> Pipfile.lock -> requirements.txt)	no	""
continue-on-error	By default, Safety will exit with a non-zero exit code if it detects any vulnerabilities. Set this to yes / true to not error out.	no	""
output-format	Output format for returned data. One of screen / text / json / bare (defaults to screen)	no	screen
args	[Advanced] Any additional arguments to pass to Safety	no	""
repo-token	—	no	""

Outputs

name	description
cli-output	CLI output from Safety
exit-code	Exit code from Safety