altinukshini/OWASP Dependecy-Track Checker
Checks OWASP Dependency-Track scan results, adds findings to PR comments, and fails workflows based on thresholds
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| api_key | Dependency-Track API Key | yes | — |
| api_url | Dependency-Track API URL | yes | — |
| project_name | Dependency-Track Project Name | yes | — |
| project_version | Dependency-Track Project Version | yes | — |
| sbom_token | Token response from Dependency Track of the uploaded SBOM file | yes | — |
| print_github_summary | Prints a summary of the Dependency-Track scan results to the GitHub Actions job summary | no | true |
| comment_results_in_pr | Comment the Dependency-Track scan results in the PR | no | true |
| fail_on_policy_violation | Fail the job if a policy violation with FAIL state is found | no | true |
| project_risk_score_threshold | Fail the job if the project risk score is above this threshold | no | -1 |
| gh_token | GitHub Token used for PR Comment | no | — |
| owner | GitHub Owner. Default current repo owner | no | — |
| repo | GitHub Repo. Default current repo | no | — |
| pr_number | GitHub PR Number. Default current PR | no | — |
Outputs
| name | description |
|---|---|
| project_uuid | The UUID of the project in Dependency-Track |
| project_risk_score | The risk score of the project in Dependency-Track |
| security_score_category | The security score category of the project in Dependency-Track |
| total_policy_violations | The total number of policy violations in the project |
| fail_policy_violations | The number of policy violations with FAIL state in the project |
| warn_policy_violations | The number of policy violations with WARN state in the project |