| ecosystems | Comma-separated list of ecosystems to check (npm, python, rust, java, bazel, actions, multitool, kubernetes, docker) | yes | — |
| min-age-days | Minimum number of days since publication to pass | no | 14 |
| warn-age-days | Age threshold for warnings. Dependencies older than min-age-days but younger than warn-age-days produce warnings instead of failures.
| no | 21 |
| base-ref | Git ref to diff against. If empty, auto-detects based on event type: pull_request uses the PR base SHA, push uses the before SHA, merge_group uses the merge group base SHA, release uses target_commitish, and other events (schedule, workflow_dispatch, etc.) use HEAD~1.
| no | "" |
| node-lockfiles | Newline-separated glob patterns for Node.js lockfiles. Supports pnpm-lock.yaml, package-lock.json, yarn.lock, and bun.lock. If empty, auto-detects changed lockfiles from the diff.
| no | "" |
| python-lockfiles | Newline-separated glob patterns for Python lockfiles. Supports uv.lock and pylock.toml (PEP 751). If empty, auto-detects changed lockfiles from the diff.
| no | "" |
| module-bazel | Path to root MODULE.bazel file (used by rust, java, and bazel ecosystems) | no | MODULE.bazel |
| workflow-files | Newline-separated glob patterns for GitHub Actions workflow files. If empty, auto-detects changed files from .github/workflows/*.yml, .github/workflows/*.yaml, action.yml, and action.yaml.
| no | "" |
| kubernetes-files | Newline-separated glob patterns for rendered Kubernetes manifest files (used by the kubernetes ecosystem). The consuming repo is responsible for rendering Helm charts or other templating tools to plain YAML manifests before invoking this action. Only @sha256-digest-pinned images are age-gated; tag-only images and images on private registries report unknown. If empty, auto-detects changed .yaml/.yml files that contain workload manifests (Deployment, StatefulSet, DaemonSet, Job, etc.).
| no | "" |
| dockerfiles | Newline-separated glob patterns for Dockerfiles/Containerfiles to scan (e.g. '**/Dockerfile'). When empty, changed files whose basename is exactly "Dockerfile" or "Containerfile" (case-insensitive) are auto-detected. Only digest-pinned images (FROM ...@sha256:...) are age-gated; tag-only images appear as unknown.
| no | "" |
| dockerhub-mirror | Docker Hub mirror hostname to use as a fallback when the primary Docker Hub registry returns an ambiguous response (e.g. HTTP 429 rate-limit) while checking whether a COPY --from or RUN --mount=from value is a real image. When set, a "unknown" result from registry-1.docker.io is retried against this mirror before deciding whether to emit the reference as a dependency. Example: mirror.gcr.io. The mirror must serve images under the same repository path as Docker Hub (including the library/ prefix for official images); mirrors that rewrite paths may incorrectly report official images as not found.
| no | "" |
| github-token | GitHub token for API queries (used by actions and bazel ecosystems to check commit/tag dates and BCR publish dates).
| no | ${{ github.token }} |
| bcr-url | Bazel Central Registry URL | no | https://bcr.bazel.build |
| npm-registry-url | npm registry URL to query for publish dates | no | https://registry.npmjs.org |
| pypi-registry-url | PyPI registry URL to query for publish dates | no | https://pypi.org |
| crates-registry-url | crates.io registry URL to query for publish dates | no | https://crates.io |
| strict-third-party | When true, archive_override without a Last-Modified header and third-party actions pinned to a branch (owner �� current repo owner) are treated as failures instead of warnings.
| no | false |
| bypass-keyword | If non-empty, failures are downgraded to warnings when this exact string is used as a bypass. On pull_request / pull_request_target events, only a matching PR label is accepted (contributor-editable sources such as the PR body and commit messages are ignored). On all other events (push, schedule, workflow_dispatch, etc.), the keyword is accepted from the HEAD commit message, or from a label on any PR associated with that commit. Useful for emergency 0-day vulnerability fixes. Add labeled and unlabeled to your pull_request event types so the action re-runs when a label is added or removed.
| no | "" |
| check-all-on-new-workflow | When true, if the workflow file that triggered this run was newly added (not present in the base ref), all packages are checked — not just changed ones. Set to "false" to disable.
| no | true |
| fetch-missing-history-retries | Maximum number of incremental `git fetch --deepen` iterations used to recover missing history on shallow checkouts (e.g. fetch-depth: 1) before falling back to the GitHub compare API. Set higher for very deep diffs.
| no | 10 |
| maven-registry-url | Maven Central registry URL. Used as the default when querying maven.install() repositories that point to Maven Central.
| no | https://repo1.maven.org/maven2 |
| target-licenses | YAML mapping of ecosystem names to comma-separated SPDX license identifiers. Use "*" as a fallback for unlisted ecosystems. A dependency is allowed if its license is compatible with any of its ecosystem's target licenses. Set to "auto" to detect from LICENSE/package.json. Set to empty string to skip license checking. Example:
target-licenses: |
"*": Apache-2.0
rust: Apache-2.0, MIT
npm: MIT
A plain string (e.g. "GPL-3.0-or-later") is treated as a wildcard applying to all ecosystems.
| no | auto |
| allowed-licenses | Deprecated: use target-licenses instead. If target-licenses is set, this input is ignored.
| no | "" |
| age-overrides | YAML mapping of ecosystem to list of package names excluded from age checking. Example:
age-overrides: |
npm:
- some-legacy-package
python:
- internal-tool
| no | "" |
| license-overrides | YAML mapping of ecosystem → package → SPDX license or "ignore". Use this to override licenses that cannot be auto-detected or to exclude packages from license checking. Example:
license-overrides: |
multitool:
buildifier: Apache-2.0
actions:
owner/repo: ignore
| no | "" |
| license-heuristics | When true, infer licenses from LICENSE/README file text using heuristic matching. When false, only use registry metadata and GitHub API; packages without explicit license metadata will be reported as unknown.
| no | false |