contrast-security-oss/actionbot
Checks your repository workflows for references to actions against a defined allow or prohibit list
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| policy | Set to either `allow` or `prohibit`. When allow is the policy, any actions not on the list will be in violation. When prohibit is the policy, any actions on the list will be in violation. | yes | — |
| policy-url | The URL to a publicly accessible or private GitHub JSON file containing a list of allowed or prohibited actions. Private URLs require appropriate permissions or authentication. | yes | — |
| fail-if-violations | True to set the status of the action to Failed if violations occur. Set to false to allow downstream actions to execute. Defaults to true. | no | true |
| github-token | Your GitHub token to access the files in the commits tied to the push or puill request. | yes | — |
Outputs
| name | description |
|---|---|
| results | A list of any actions breaking the provided policy rules. |