valinora/GHSS - GitHub Supply-chain Security Audit
Audit GitHub Actions workflows for supply-chain vulnerabilities
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| severity-threshold | Minimum severity to fail on: critical, high, medium, low | yes | — |
| github-token | GitHub token for API access (mutually exclusive with github-app-* inputs) | no | ${{ github.token }} |
| github-app-id | GitHub App ID (alternative to github-token) | no | — |
| github-app-installation-id | GitHub App installation ID (alternative to github-token) | no | — |
| github-app-private-key | GitHub App private key PEM content (alternative to github-token) | no | — |
| provider | Advisory provider: ghsa, osv, all | no | all |
| depth | Recursive expansion depth (0 = flat, integer, or "unlimited") | no | 0 |
| deps | Scan dependencies for known vulnerabilities (true/false) | no | false |
| version | ghss release tag to download (e.g. "ghss-cli-v0.2.0" or "latest") | no | ghss-cli-v0.2.0 |
Outputs
no outputs