This action checks your composer.lock for known vulnerabilities in your package dependencies.
lockoptional The path to thecomposer.lockfile (defaults to the repository root directory).formatoptional The output format (defaults toansi, supported:ansi,junit,markdown,json, oryaml).disable-exit-codeoptional Set it to1if you don't want the step to fail in case of detected vulnerabilities
vulnsA JSON payload containing all detected vulnerabilities
If you want the step to fail whenever there is a security issue in one of your dependencies, use this action:
steps:
- uses: actions/checkout@v2
- uses: symfonycorp/security-checker-action@v5
To speed up security checks, you can cache the vulnerability database:
steps:
- uses: actions/checkout@v2
- uses: actions/cache@v2
id: cache-db
with:
path: ~/.symfony/cache
key: db
- uses: symfonycorp/security-checker-action@v5
If the composer.lock is not in the repository root directory, pass is as an
input:
steps:
- uses: actions/checkout@v2
- uses: symfonycorp/security-checker-action@v5
with:
lock: subdir/composer.lock
Instead of failing, you can also get the vulnerabilities as a JSON output and do something with them in another step:
steps:
- uses: actions/checkout@v2
- uses: symfonycorp/security-checker-action@v5
with:
disable-exit-code: 1
id: security-check
- name: Display the vulnerabilities as JSON
run: echo ${{ steps.security-check.outputs.vulns }}
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent