spielernogard/uv-audit
Scan Python dependency files for known vulnerabilities and report findings on PRs.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Root directory for discovery | no | . |
| include | Newline-separated glob patterns to match | no | **/pyproject.toml **/requirements*.txt |
| exclude | Newline-separated path components or globs to skip | no | .venv venv .tox node_modules .git dist build site-packages |
| ignore_vulns | Newline-separated vulnerability IDs to suppress | no | "" |
| fail_on_vuln | Exit non-zero when non-ignored vulnerabilities are found | no | true |
| pyproject_args | Extra CLI args appended to uv-audit for pyproject scans | no | --all |
| uv_audit_version | Version of uv-audit2 to install from PyPI (kept in sync via commitizen) | no | 0.3.3 |
| uv_audit_source | Optional installable source for uv-audit (path or VCS URL); when set, overrides uv_audit_version | no | "" |
| comment_on_pr | Create or update the sticky PR comment when running in PR context | no | true |
| github_token | Token used for the comment API | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| vulnerable | 'true' when non-ignored vulnerabilities were found |
| vuln_count | Number of non-ignored findings |
| ignored_count | Number of ignored findings |
| report_json | Aggregated JSON report as a string |