yowainwright/Pastoralist

Audit, secure, and clean up package manager overrides for npm, pnpm, Yarn, and Bun

Trust Signals

name	description	required	default
mode	Operation mode: check (validate only), update (modify files), or pr (create PR with changes)	no	update
check-security	Enable security vulnerability scanning (true/false)	no	true
security-provider	Security provider to use (osv, github, npm, snyk, socket, spektion)	no	osv
security-token	Token for security provider (required for github, snyk, socket, spektion)	no	—
auto-fix	Automatically apply security fixes (true/false)	no	true
dry-run	Preview changes without modifying files (true/false)	no	false
root-dir	Root directory of the project	no	—
dep-paths	Workspace package.json patterns (space-separated globs or "workspace")	no	—
config	Deprecated. Config files are auto-detected from root-dir	no	—
fail-on-security	Fail the action if security vulnerabilities are found (true/false)	no	true
fail-on-unused	Fail the action if unused overrides are detected (true/false)	no	false
silent	Deprecated compatibility input; ignored and will be removed in a future major release	no	false
debug	Enable debug logging (true/false)	no	false
pr-title	Title for auto-created PR (mode: pr only)	no	chore(deps): update dependency overrides
pr-body	Body for auto-created PR (mode: pr only)	no	—
pr-branch	Branch name for auto-created PR (mode: pr only)	no	pastoralist/updates
pr-labels	Labels to add to PR (space-separated, mode: pr only)	no	dependencies
github-token	GitHub token for creating PRs (defaults to GITHUB_TOKEN)	no	—

name	description
has-security-issues	Whether security vulnerabilities were found (true/false)
has-unused-overrides	Whether unused overrides were detected (true/false)
updated	Whether package.json was modified (true/false)
security-count	Number of security vulnerabilities found
unused-count	Number of unused overrides detected
override-count	Number of overrides tracked after the run
pr-url	URL of created PR (mode: pr only, empty if no changes)