Home

Awesome

PHP Security Checker

This action checks your composer.lock for known vulnerabilities in your package dependencies.

Inputs

Outputs

Usage

If you want the step to fail whenever there is a security issue in one of your dependencies, use this action:

steps:
    - uses: actions/checkout@v4
    - uses: symfonycorp/security-checker-action@v5

To speed up security checks, you can cache the vulnerability database:

steps:
    - uses: actions/checkout@v4
    - uses: actions/cache@v2
      id: cache-db
      with:
          path: ~/.symfony/cache
          key: db
    - uses: symfonycorp/security-checker-action@v5

If the composer.lock is not in the repository root directory, pass is as an input:

steps:
    - uses: actions/checkout@v4
    - uses: symfonycorp/security-checker-action@v5
      with:
          lock: subdir/composer.lock

Instead of failing, you can also get the vulnerabilities as a JSON output and do something with them in another step:

steps:
    - uses: actions/checkout@v4
    - uses: symfonycorp/security-checker-action@v5
      with:
          disable-exit-code: 1
      id: security-check
    - name: Display the vulnerabilities as JSON
      run: echo ${{ steps.security-check.outputs.vulns }}