| repository | The GitHub repository to analyze, as `owner/name` (the action always assumes github.com as the host). Defaults to the repository the workflow is running in. Ignored when `ecosystem` is set. Use GitHub's canonical `owner/name` casing: the auto-built mirror is keyed on this value, and the tool matches mirrors case-sensitively against the repository's canonical URL, so mismatched casing silently disables the mirror (and thus private-repo cloning and branch-under-test mapping). The default (`github.repository`) is already canonical. | no | ${{ github.repository }} |
| ecosystem | Value for the `--ecosystem` flag. When set, `package` is analyzed as a package name in this ecosystem instead of the `repository`. One of: npm, python, pypi, go. Leave empty to analyze a GitHub repository. | no | "" |
| package | The package name to analyze. Only used (and required) when `ecosystem` is set; ignored otherwise. | no | "" |
| csv-path | Path (relative to the workspace) of the committed LICENSE-3rdparty.csv file to validate against. Required only when `compare` is 'true'; in that mode, the repository must already be checked out. | no | LICENSE-3rdparty.csv |
| override-spec | Value for the `--override-spec` flag: a file with a JSON array of override rules. Leave empty to disable overrides. | no | "" |
| compare | When 'true' (default), the generated SBOM must match `csv-path` exactly or the action fails, printing a unified diff. When 'false', only structural validation is performed (the output must be a non-empty CSV with the expected header) — useful on secondary runtimes where the dependency closure legitimately differs. | no | true |
| github-sbom-strategy | Set to 'false' to pass --no-github-sbom-strategy. Note: this strategy reads GitHub's dependency graph for the repository (its default/base branch), which is not affected by the branch-under-test mirror. When validating dependency changes on a PR, consider setting this to 'false' so discovery is driven by the source-based strategies instead. | no | true |
| gopkg-strategy | Set to 'false' to pass --no-gopkg-strategy. | no | true |
| pypi-strategy | Set to 'false' to pass --no-pypi-strategy. | no | true |
| npm-strategy | Set to 'false' to pass --no-npm-strategy. | no | true |
| scancode-strategy | Set to 'false' to pass --no-scancode-strategy. | no | true |
| experimental-strategy | Set to 'true' to pass --experimental-strategy. | no | false |
| deep-scanning | Set to 'true' to pass --deep-scanning. | no | false |
| yarn-subdir | Newline-separated subdirectory paths containing additional yarn.lock files. Each non-empty line is passed as a separate `--yarn-subdir` argument. Paths are relative to the repository root. | no | "" |
| default-branch | The default branch of `repository`, used as the source ref when the action maps the mirror onto the branch under test (the PR head branch, the merge-queue branch, or the pushed branch). Only relevant when validating the repository the workflow runs in. Defaults to that repository's actual default branch (from the event payload); override only if the event context does not expose it. | no | ${{ github.event.repository.default_branch }} |
| use-mirrors | Path (in the checked-out workspace) to a JSON file of mirror specifications for callers with special needs. Its entries are merged ahead of the mirror the action builds automatically, so they take precedence for any overlapping original_url (the tool uses the first matching entry) while the auto-built entry for the repository remains as a fallback. In ecosystem mode (no auto-built mirror), it is passed through verbatim to `--use-mirrors`. Leave empty to rely solely on the auto-built mirror. | no | "" |
| github-token | GitHub token used both for API calls and, embedded in the generated mirror URL, for cloning the repository under test. Leave empty (the default) for untrusted or public targets because dependency analysis may execute target-controlled code that inherits the action environment. Providing a token with read access is required for private repositories. | no | "" |
| python-version | Python version to set up and run dd-license-attribution with. Set to 'false' to skip the internal Python setup entirely and use the `python` already on PATH (e.g. when the calling workflow has set it up). | no | 3.14 |
| go-version | Go version to set up when the GoPkg strategy is enabled or `ecosystem` is `go`. Required for analyzing Go dependencies. Set to 'false' to skip the internal Go setup entirely and use the calling workflow's Go toolchain. | no | 1.23 |
| node-version | Node.js version to set up when the NPM strategy is enabled or `ecosystem` is `npm`. The setup includes npm and Yarn Classic. Set to 'false' to skip the internal JavaScript toolchain setup entirely and use the calling workflow's Node.js, npm, and Yarn installations. | no | 24 |