depproof

Release · Scanner

The depproof scanner — self-hosted dependency & license audit

One step in your pipeline audits every dependency for known vulnerabilities and license risk — across Java, JavaScript, and Python — and hands you a CycloneDX SBOM, a readable report, and a pass/fail gate. It runs self-hosted in GitHub Actions or GitLab CI; your source never leaves the runner.

Released 28 Jul 2026 · see the changelog

Easy to configure — start with zero config

The Action auto-discovers your Maven, Gradle, npm, and Python manifests, so the minimal setup is a single step with no options. Everything is tunable when you need it — see the full input list in action.yml.

GitHub Actions

Add this workflow — it discovers everything and gates the pull request:

# .github/workflows/audit.yml
name: dependency-audit
on: [pull_request]

jobs:
  depproof:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: depproof/depproof-action@v1   # zero-config: finds every manifest
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: depproof-report
          path: |
            depproof-report.html
            depproof-*.json

Tighten the gate or scope it whenever you like:

      - uses: depproof/depproof-action@v1
        with:
          fail-on: high        # critical | high | medium | low | none
          exclude: 'fixtures/**,examples/**'

What it generates on GitHub

  • A pass/fail check on the PR — the job exits non-zero when findings cross your fail-on threshold, so a bad CVE blocks the merge, not the release.
  • depproof-report.html — a self-contained report you can open offline, uploaded as a build artifact.
  • depproof-sbom-<manifest>.json — a CycloneDX SBOM per manifest.
  • depproof-summary.json — a stable machine-readable summary for downstream steps.

GitLab CI

The same scan runs as a GitLab job from the public container — and the CycloneDX SBOM feeds straight into GitLab’s native Dependency List: 

# .gitlab-ci.yml — on a Docker-enabled runner
depproof:
  script:
    - >
      docker run --rm -v "$CI_PROJECT_DIR":/workspace -w /workspace
      ghcr.io/depproof/depproof:v0
      scan --discover --root /workspace --fail-on high --html --output-dir /workspace
  artifacts:
    when: always
    paths:
      - depproof-report.html
      - depproof-*.json
    reports:
      cyclonedx: depproof-sbom-*.json   # -> GitLab Dependency List

What it generates on GitLab

  • A pass/fail pipeline gate — same non-zero exit on findings over threshold.
  • The HTML report + SBOMs as job artifacts — downloadable from the pipeline.
  • Native Dependency List integration — reports: cyclonedx lands the SBOM in GitLab’s dependency view, no extra tooling.

What the scanner covers

  • Four ecosystems, full transitive tree. Maven (no build), Gradle (after your build), npm / pnpm / yarn / bun (from the lockfile), and Python — poetry, pdm, uv, Pipfile, or requirements.txt (from the lockfile).
  • Vulnerabilities on open data. Every dependency is checked against OSV.dev — CVE/GHSA advisories and malicious-package advisories — with CVSS scores and fix versions. No proprietary database to lock you in.
  • License risk, classified. Each dependency’s license is normalized to SPDX and flagged, so a prohibited or copyleft license can’t hide in the tree.
  • A CycloneDX SBOM + HTML report every run — the evidence artifacts compliance and procurement ask for.
  • Self-hosted, no per-seat bill. The scan runs inside your runner or container, and your source never leaves it. It’s software composition analysis you own.

Honest scope

  • Java, JavaScript, and Python at the time of this post. Go was on the roadmap then, not shipped — we’d rather say so than list it. Update, 30 Jul 2026: Go module support has since shipped — see the changelog.
  • Per-repo, in CI. Rolling every repo’s results into one cross-repo, org-wide view is the job of the depproof hub — a separate, self-hosted piece.
  • An SBOM is an inventory. Signed attestations and VEX are separate artifacts; the scanner generates the SBOM, not those.
Start your first audit → See action.yml

Free for open source and teams under $1M revenue — see pricing. Follow releases on the changelog (RSS). Product names are used nominatively.