jessehouwing/Download CodeQL Actions Dependencies
Downloads remote composite actions and callable workflows into the directory structure expected by the CodeQL Actions extractor, enabling interprocedural analysis of third-party action internals.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| token | GitHub token with contents:read for fetching remote action/workflow source files. For private actions in other repos, use a PAT or GitHub App token with appropriate access. | yes | ${{ github.token }} |
| workflow-directory | Directory containing workflow files to scan | no | .github/workflows |
| public-github-token | GitHub token for public GitHub when running on GHES/EMU/DR. Used to look up actions not available on the local instance. | no | "" |
| mode | Operating mode. When set to "legacy", the action also writes the first encountered version of each composite action and callable workflow to the SHA-less paths `.github/actions/external/{owner}/{repo}/[actionPath/]action.yml` and `.github/workflows/external/{owner}/{repo}/{path}/file.yml`. If a different version of the same dependency is also referenced, a warning is logged but processing continues. | no | "" |
Outputs
| name | description |
|---|---|
| actions-count | Number of composite actions downloaded |
| workflows-count | Number of callable workflows downloaded |