tikotiktok/Depenemy Dependency Scanner
Scans dependencies for behavioral issues, reputation red flags, and supply chain risks
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| token | GitHub token for author and contributor lookups (optional - unlocks R001 and R006 checks) | no | ${{ github.token }} |
| paths | Space-separated paths to scan (default: repository root) | no | . |
| fail-on | Minimum severity level that causes the action to fail (error|warning|info|never) | no | error |
| output-sarif | Path to write SARIF output file (enables GitHub Code Scanning upload) | no | depenemy.sarif |
| config | Path to .depenemy.yml config file | no | "" |
| ecosystems | Comma-separated list of ecosystems to scan (npm,pypi,cargo) - default is auto-detect | no | "" |
| upload-sarif | Automatically upload SARIF to GitHub Code Scanning | no | true |
Outputs
| name | description |
|---|---|
| sarif-file | Path to the generated SARIF file |
| findings-count | Total number of findings |
| errors-count | Number of error-level findings |