yanovian/Open License Auditor
Maps every dependency in a repo, direct and transitive, and flags risky open source licenses
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| config-path | Path to the audit config file in this repo | no | .github/license-audit.yml |
| severity-filter | Which findings to show in the PR comment: critical, warning, both, or none | no | both |
| fail-on | Which findings make the Action exit non-zero: critical, warning, or none | no | critical |
| comment-on-pr | Whether to post a PR comment with the results | no | true |
| comment-only-on-problems | If true, skip posting a comment at all when no problems are found | no | false |
| update-existing-comment | If true, edit the bot's previous comment instead of posting a new one each run | no | true |
| github-token | Token used to read PR context and post comments | no | ${{ github.token }} |
| cache | Whether to cache license lookups across workflow runs | no | true |
Outputs
| name | description |
|---|---|
| has-critical | true if any dependency was classified as critical |
| has-warning | true if any dependency was classified as warning |
| report-path | Path to the full JSON dependency and license report written to disk |