Automate Python CVE Scanning in GitHub Actions GitHub Actions
Add Python requirements.txt CVE scanning to GitHub Actions. Catch vulnerable PyPI packages on every push.
Python security scan in GitHub Actions
Use OSV Scanner or pip-audit in CI to flag vulnerable Python packages automatically.
name: Python Security Scan
on: [push, pull_request]
jobs:
python-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: pypa/gh-action-pip-audit@v1.0.8
with:
inputs: requirements.txt
✓ Manual Scan
For a quick one-off scan before deployment, paste your manifest into PackageFix — no pipeline setup needed.
Scan your dependencies now — paste your manifest, get a fixed version back in seconds.
Open PackageFix →No signup · No CLI · No GitHub connection · Runs 100% in your browser
Frequently Asked Questions
How do I add dependency scanning to GitHub Actions?
Add OSV Scanner or the ecosystem-specific audit tool to your GitHub Actions build configuration. The config snippet above works out of the box.
Does PackageFix integrate with CI/CD pipelines?
PackageFix is a browser tool for manual scans. For automated CI scanning, use OSV Scanner (Google) or pip-audit/npm audit in your pipeline. PackageFix generates the Renovate config and GitHub Actions workflow you can copy.
How do I fail a GitHub Actions build on critical CVEs?
Add --audit-level=critical to npm audit, or --fail-on=critical to pip-audit. The pipeline aborts if critical CVEs are found.
What is the OSV Scanner?
OSV Scanner is Google's open-source CLI tool that queries the same OSV database PackageFix uses. It's ideal for CI/CD integration.