With1.8.0

Don't block PRs below this severity. Possible values are low, moderate, high, critical.

Dependency scopes to block PRs on. Comma-separated list. Possible values are 'unknown', 'runtime', and 'development' (e.g. "runtime, development")

The base git ref to be used for this check. Has a default value when the workflow event is pull_request or pull_request_target. Must be provided otherwise.

The head git ref to be used for this check. Has a default value when the workflow event is pull_request or pull_request_target. Must be provided otherwise.

A path to the configuration file for the action.

Comma-separated list of allowed licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause")

Comma-separated list of forbidden licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause")

Comma-separated list of dependencies in purl format (e.g. "pkg:npm/express, pkg:pypi/pycrypto"). These dependencies will be permitted to use any license, no matter what license policy is enforced otherwise.

Comma-separated list of allowed GitHub Advisory IDs (e.g. "GHSA-abcd-1234-5679, GHSA-efgh-1234-5679")

A token for fetching external configuration file if it lives in another repository. It is required if the repository is private

A boolean to determine if license checks should be performed

A boolean to determine if vulnerability checks should be performed

Determines if the summary is posted as a comment in the PR itself. Setting this to always or on-failure requires you to give the workflow pull-requests: write permissions

A comma-separated list of package URLs to deny (e.g. "pkg:npm/express, pkg:pypi/pycrypto"). If version specified, only deny matching packages and version; else, deny all regardless of version.

A comma-separated list of package URLs for group(s)/namespace(s) to deny (e.g. "pkg:npm/express/, pkg:pypi/pycrypto/"). Please note that the group name must be followed by a /.

Whether to retry on snapshot warnings

Number of seconds to wait before stopping snapshot retries.

When set to true this action will always complete with success, overriding the fail-on-severity parameter.

Show a summary of the OpenSSF Scorecard scores.

Numeric threshold for the OpenSSF Scorecard score. If the score is below this threshold, the action will warn you.

When set to true, the vulnerability summary table will include a column showing the first patched version for each vulnerability.