actions-marketplace-validations/Package Policy
Checks the package manifest (package.json) for references to packages contained in a provided list
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
- Runtime
- Deprecated runtime
Inputs
| name | description | required | default |
|---|---|---|---|
| policy | Set to either `allow` or `prohibit`. When allow is the policy, any packages not on the list will be in violation. When prohibit is the policy, any packages on the list will be in violation. | yes | — |
| policy-url | The url to a publicly available json file containing a list of allowed or prohibited packages. | yes | — |
| fail-if-violations | True to set the status of the action to Failed if violations occur. Set to false to allow downstream packages to execute. Defaults to true. | no | true |
| include-dev-dependencies | True to enforce the policy against packages in the `devDependencies` node. Defaults to false. | no | false |
| github-token | Your GitHub token to access the files in the commits tied to the push or puill request. | yes | — |
Outputs
| name | description |
|---|---|
| results | A list of any packages breaking the provided policy rules. |