advanced-security/Component Detection dependency submission action
Upload information about your dependencies to the GitHub dependency graph using dependency submission API.
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 8–10scored Jul 13, 2026
- Maintenance Recency
- Activelast commit Jul 6, 2026
- License
- MIT
Pinned Snippet
uses: advanced-security/component-detection-dependency-submission-action@31f25a8de68ae5ce2ca274bc28546a78683c15ce # v0.1.4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| token | GitHub Personal Access Token (PAT). Defaults to PAT provided by Actions runner. | no | ${{ github.token }} |
| filePath | The path to the directory containing the environment files to upload. Defaults to Actions working directory. | no | . |
| directoryExclusionList | Filters out specific directories following a minimatch pattern. | no | — |
| detectorArgs | Comma separated list of properties that can affect the detectors execution, like EnableIfDefaultOff that allows a specific detector that is in beta to run, the format for this property is DetectorId=EnableIfDefaultOff, for example Pip=EnableIfDefaultOff. | no | — |
| dockerImagesToScan | Comma separated list of docker image names or hashes to execute container scanning on, ex: ubuntu:16.04,56bab49eef2ef07505f6a1b0d5bd3a601dfc3c76ad4460f24c91d6fa298369ab | no | — |
| detectorsFilter | A comma separated list with the identifiers of the specific detectors to be used. This is meant to be used for testing purposes only. | no | — |
| detectorsCategories | A comma separated list with the categories of components that are going to be scanned. The detectors that are going to run are the ones that belongs to the categories. The possible values are: Npm, NuGet, Maven, RubyGems, Cargo, Pip, GoMod, CocoaPods, Linux. | no | — |
| correlator | An optional identifier to distinguish between multiple dependency snapshots of the same type. | no | — |
| detector-name | The name of the detector. If provided, detector-version and detector-url must also be provided. | no | — |
| detector-version | The version of the detector. If provided, detector-name and detector-url must also be provided. | no | — |
| detector-url | The URL of the detector. If provided, detector-name and detector-version must also be provided. | no | — |
| snapshot-sha | The SHA of the commit to associate with the snapshot. If provided, snapshot-ref must also be provided. | no | — |
| snapshot-ref | The Git reference to associate with the snapshot. If provided, snapshot-sha must also be provided. | no | — |
Outputs
no outputs