chains-project/Dirty Waters Analysis
Analyze software supply chain issues in your dependencies
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Dec 22, 2025
- License
- MIT
Pinned Snippet
uses: chains-project/dirty-waters-action@30bc4ef96e9c59f85efb05affc2992353d65870b # v1.11.52tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| github_token | GitHub token | yes | — |
| project_repo | Project repository path (as in GitHub) | no | ${{ github.repository }} |
| version_old | Release version to analyze - old if differential analysis | no | — |
| version_new | New release version for differential analysis | no | — |
| differential_analysis | Whether to perform differential analysis | no | false |
| package_manager | Package manager used in the project | yes | — |
| name_match | Compare the package names with the name in the in the package.json file. This option will slow down the execution time due to the API rate limit of code search | no | false |
| specified_smells | List of specified smells to analyze. Provide it as a space-separated list of smells (e.g., "--check-source-code --check-forks") | no | — |
| debug | Enable debug mode | no | false |
| config | Path to the configuration file, relative to the root of the project | no | — |
| gradual_report | Enable gradual report functionality | no | true |
| fail_on_high_severity | Break CI if high severity issues are found | no | true |
| x_to_fail | Percentage threshold for the number of high or medium severity issues to fail the CI | no | 0 |
| allow_pr_comment | Post analysis results as a PR comment if CI breaks | no | true |
| comment_on_commit | Post analysis results as a commit comment if CI breaks | no | false |
| github_event_before | GitHub event before SHA, to retrieve the previous cache key | no | ${{ github.event.before }} |
| ignore_cache | Ignore the repository cache for this run | no | false |
Outputs
no outputs