risk-guard/Risk Guard
Open source supply-chain risk scanning (security, license, maintenance, provenance) that emits SARIF for GitHub code scanning.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 1, 2026
- License
- MIT
Pinned Snippet
uses: risk-guard/action@de7327dd13745eae30e7fcea7aa1a506e6cdeab1 # v1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to the git repository to scan. | no | ./ |
| go-version | Go toolchain version used to install risk-guard. | no | 1.25.1 |
| version | risk-guard version/ref to install (becomes `@<version>` for `go install`). | no | latest |
| args | Extra flags appended to the risk-guard command (e.g. "--mode active"). | no | "" |
| annotate | Render inline PR/workflow annotations by passing `--github`. | no | true |
| sarif | Upload the SARIF report to GitHub code scanning. | no | true |
| sarif-file | Path of the SARIF report risk-guard writes. | no | risk-guard-report.sarif |
| category | Code scanning category for the uploaded SARIF. | no | risk-guard |
| upload-artifact | Upload the SARIF report as a build artifact. | no | true |
| cache | Cache the risk-guard cache directory between runs. | no | true |
| cache-dir | Directory used for the risk-guard cache. | no | ${{ github.workspace }}/.risk-guard-cache |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the SARIF report produced by the scan. |