A GitHub Action that audits npm and PyPI packages for supply chain risk, posting risk tables directly as PR comments:
- uses:piiiico/proof-of-commitment@mainwith:comment-on-pr:true# posts audit table as a PR comment
Auto-detects packages from package.json or requirements.txt. Outputs:
PR comment with risk table (updates on re-run, no spam)
GitHub Step Summary with full audit results
Optionally fails on CRITICAL packages (fail-on-critical: true)
The scoring is based on behavioral signals (maintainer activity, ownership concentration, release cadence) rather than just CVEs — surfaces risk like single-maintainer packages with 100M+ weekly downloads.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/sdras/awesome-actions/pull/774
**Author:** [@piiiico](https://github.com/piiiico)
**Created:** 4/25/2026
**Status:** 🔄 Open
**Base:** `main` ← **Head:** `add-proof-of-commitment`
---
### 📝 Commits (1)
- [`a554fcc`](https://github.com/sdras/awesome-actions/commit/a554fcccb69e214e7324d35d75ceac4cf0408ef1) Add Supply Chain Audit with Proof of Commitment to Security section
### 📊 Changes
**1 file changed** (+1 additions, -0 deletions)
<details>
<summary>View changed files</summary>
📝 `README.md` (+1 -0)
</details>
### 📄 Description
## Summary
Adds [Supply Chain Audit with Proof of Commitment](https://github.com/piiiico/proof-of-commitment) to the **Security** section.
## What it does
A GitHub Action that audits npm and PyPI packages for supply chain risk, posting risk tables directly as PR comments:
```yaml
- uses: piiiico/proof-of-commitment@main
with:
comment-on-pr: true # posts audit table as a PR comment
```
Auto-detects packages from `package.json` or `requirements.txt`. Outputs:
- PR comment with risk table (updates on re-run, no spam)
- GitHub Step Summary with full audit results
- Optionally fails on CRITICAL packages (`fail-on-critical: true`)
The scoring is based on **behavioral signals** (maintainer activity, ownership concentration, release cadence) rather than just CVEs — surfaces risk like single-maintainer packages with 100M+ weekly downloads.
Web demo: https://getcommit.dev/audit
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/sdras/awesome-actions/pull/774
Author: @piiiico
Created: 4/25/2026
Status: 🔄 Open
Base:
main← Head:add-proof-of-commitment📝 Commits (1)
a554fccAdd Supply Chain Audit with Proof of Commitment to Security section📊 Changes
1 file changed (+1 additions, -0 deletions)
View changed files
📝
README.md(+1 -0)📄 Description
Summary
Adds Supply Chain Audit with Proof of Commitment to the Security section.
What it does
A GitHub Action that audits npm and PyPI packages for supply chain risk, posting risk tables directly as PR comments:
Auto-detects packages from
package.jsonorrequirements.txt. Outputs:fail-on-critical: true)The scoring is based on behavioral signals (maintainer activity, ownership concentration, release cadence) rather than just CVEs — surfaces risk like single-maintainer packages with 100M+ weekly downloads.
Web demo: https://getcommit.dev/audit
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.