sky2194/Dependency Analyzer Security Scan
Scan your dependencies for CVE vulnerabilities and post a full report to your PR — never blocks your pipeline
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| manifest-file | Path to the dependency manifest. Supported: package.json (npm), requirements.txt (PyPI), pom.xml (Maven). If omitted, the Action auto-detects whichever manifest exists in the workspace. | no | package.json |
| api-url | Dependency Analyzer API base URL | no | https://depanalyzer.com |
| github-token | GitHub token used to post PR comments | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| risk-score | Composite risk score (0–100) |
| scan-url | URL to view the full scan report in the DepAnalyzer app |
| critical | Number of Critical severity CVEs found |
| high | Number of High severity CVEs found |
| kev-count | Number of CISA KEV (actively exploited) CVEs found |