Documentation — PackageMedic

Recommended pull-request workflow

GitHub Actions YAML

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v6
    with:
      fetch-depth: 0
  - uses: GonzMeza/package-medic@v0.6.1
    with:
      path: .
      audit: 'true'
      include-transitive-audit: 'true'
      deprecated: 'true'
      include-transitive-deprecated: 'true'
      fail-on: warning
      annotations: new
      upload-sarif: 'true'
      upload-artifact: 'true'

Key inputs

Input	Default	Purpose
`path`	`.`	Project, solution, slnx, or directory inside GITHUB_WORKSPACE.
`tool-version`	0.6.1	Exact PackageMedic.Tool version; wildcards are rejected.
`restore`	true	Restore before analysis.
`config`	unset	Repository-relative PackageMedic configuration.
`baseline`	unset	Repository-relative portable baseline.
`mode`	auto	Use unprivileged pull_request diff automatically, or force scan / diff.
`fail-on / fail-on-new`	unset	Override policy thresholds when supplied.
`audit`	false	Request official NuGet vulnerability evidence.
`include-transitive-audit`	true	Include transitive packages after audit is enabled.
`deprecated`	false	Request official NuGet deprecation evidence.
`include-transitive-deprecated`	false	Include transitive deprecated packages.
`diff-base`	unset	Reachable Git ref that overrides mode.
`verify`	unset	In diff mode, require immutable restore, build, or test evidence.
`build-timeout`	900	Bound each generated build target in seconds.
`test-timeout`	1200	Bound each generated test project in seconds.
`verification-configuration`	Release	Configuration shared by verified build and test stages.
`annotations`	new	Emit new, all, or no native file annotations.
`upload-sarif`	true	Upload deterministic SARIF to Code Scanning.
`upload-artifact`	true	Retain JSON and SARIF for 14 days.
`max-parallelism`	automatic, up to 4	Bound concurrent restore, audit, and MSBuild work.

Outputs and isolation

Later steps can read exit-code, json-file, sarif-file,errors, warnings, information, package direction counts, PM007/PM008 introduced/resolved/persistent counts, artifact-name, and sarif-category. Every action invocation gets an isolated report directory, artifact name, and SARIF category so repeated scans cannot overwrite each other.

Pull-request comparisons additionally expose impact-gate-passed,impact-violations, impact-added-direct,impact-added-transitive, impact-max-blast-radius, andimpact-source-changes, and impact-content-changes. The job summary lists failed PMI policies and their causal dependency paths.

Verified comparisons additionally expose verification-status, build/test regression flags, candidate test counts, verification-incomplete,sbom-file, sbom-created, provenance-file, andprovenance-created.

Pull-request graph diff

GitHub Actions YAML

- uses: actions/checkout@v6
  with:
    fetch-depth: 0

- uses: GonzMeza/package-medic@v0.6.1
  with:
    audit: 'true'
    deprecated: 'true'
    fail-on: warning

Auto mode uses the base SHA for an unprivileged pull_request event and rejectspull_request_target, whose default checkout would compare the base against itself. Fetch enough history so the base already exists locally; PackageMedic never fetches or changes Git. diff-base is an explicit override. Diff rejects baseline and fail-on-new because the Git comparison already defines which findings are new.

The same run evaluates the committed impact configuration. A policy failure returns exit code 1 even when diagnostic fail-on isnone; an incomplete base or current graph returns 2.

PackageMedic 0.6 also implements opt-in immutable restore, build, and test comparison. Its runner policy and evidence outputs are documented under Verified experiments.

Action security boundaries

The default tool source is exclusively NuGet.org.
Offline local sources are accepted only inside the workspace or runner temporary directory.
Scan, configuration, baseline, and output paths cannot escape their allowed roots.
Report files are size-checked before JavaScript parses them.
Custom artifact, category, and output values are validated before use.