jessehouwing/Azure Pipelines Dependency Submission
Submit Azure Pipelines dependencies to GitHub Dependency Graph for vulnerability scanning
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | GitHub token with contents:write permission for dependency submission. This token is used to submit dependencies to the GitHub Dependency Graph API. Defaults to the repository's GITHUB_TOKEN. | no | ${{ github.token }} |
| github-readonly-token | GitHub token with contents:read permission for accessing private repositories when resolving pipeline templates. This allows the action to read template files from private repositories referenced in your pipelines. If not provided, falls back to the 'github-token' input. Only needed if your pipelines reference templates from private repositories. | no | "" |
| repository | Repository to submit dependencies for (owner/repo format) | no | ${{ github.repository }} |
| azure-devops-url | Azure DevOps organization URL (e.g., https://dev.azure.com/myorg) | yes | — |
| azure-devops-token | Azure DevOps Personal Access Token (PAT) with the following permissions: - Agent Pools: Read - Build: Read - Marketplace: Read. This token is used to query the installed task definitions from the Azure DevOps organization and enrich dependencies with Azure DevOps Marketplace metadata. To create a PAT, go to User Settings > Personal Access Tokens in Azure DevOps. | yes | — |
| pipeline-paths | Comma-separated or newline-separated list of glob patterns to scan for Azure Pipelines files. Supports wildcards like *.yml, **/*.yaml, etc. Defaults to azure-pipelines.yml, azure-pipelines.yaml, and .azure-pipelines/*.yml if not specified. | no | "" |
| resolve-templates | Whether to resolve and include dependencies from pipeline templates. When true (default), template files are parsed and their tasks are included as dependencies. | no | true |
| parse-templates-by | How to parse and resolve pipeline templates. Options: 'action' (default) or 'server'. When set to 'server', uses the Azure DevOps Preview Run API to expand templates and apply decorators on the server side, providing more accurate results. This is slower than 'action' mode but captures decorator-injected tasks and fully resolved templates. Requires Build Read permissions on the Azure DevOps token. | no | action |
| azure-devops-project | Azure DevOps project name to query for build definitions when using 'server' mode for parse-templates-by. If not specified, the action will attempt to query all accessible projects. | no | "" |
Outputs
| name | description |
|---|---|
| dependency-count | Number of dependencies submitted |