jessehouwing/GitHub Actions Dependency Submission
Submit workflow dependencies to Dependency Graph with composite actions and fork support
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| token | GitHub token with contents:write permission for dependency submission. If workflows reference private or internal actions in other repositories, ensure those repositories are configured to allow access. The token will automatically have contents:read access to allowed repositories. | yes | ${{ github.token }} |
| repository | Repository to submit dependencies for (owner/repo format) | no | ${{ github.repository }} |
| workflow-directory | Directory containing workflow files to scan | no | .github/workflows |
| additional-paths | Additional paths to scan for composite actions and callable workflows (comma-separated or newline-separated) | no | "" |
| fork-organizations | Comma-separated list of organization names that contain forked actions | no | — |
| fork-regex | Regular expression pattern to transform forked repository names to original names. Must contain named captures 'org' and 'repo' (e.g., '(?<org>[^/]+)/(?<repo>actions-.+)') | no | — |
| public-github-token | GitHub token with contents:read permission for accessing public GitHub (api.github.com) when running on EMU, GitHub-DR, or GHES instances. Used to look up original actions from public GitHub when they are not found on the local instance. See environment-specific documentation in docs/ for setup instructions. | no | — |
| report-transitive-as-direct | Whether to report transitive dependencies as direct. When true, all dependencies are reported as direct. When false (default), transitive dependencies (from composite actions and original repositories) are reported as indirect. | no | false |
| detect-docker | Whether to detect and report Docker image dependencies from workflows, actions, and Dockerfiles. When true, extracts Docker images from job containers, service containers, docker:// step references, and Dockerfile base images. When false (default), only GitHub Actions dependencies are reported. This is an experimental feature - please report any issues on GitHub. | no | false |
Outputs
| name | description |
|---|---|
| dependency-count | Number of dependencies submitted |