karanshah229/Dependabot Vulnerability SLA Check

Checks Dependabot alerts against SLA thresholds by severity and sends Slack notifications

Trust Signals

name	description	required	default
slack_webhook_url	Slack webhook URL for sending notifications	no	—
dependabot_token	Fine-grained PAT with "Dependabot alerts: Read" permission	yes	—
sla_config	JSON array of severity/duration objects. Example: [{"severity": "critical", "duration": 30}, {"severity": "high", "duration": 60}]	no	[{"severity": "critical", "duration": 30}, {"severity": "high", "duration": 60}, {"severity": "moderate", "duration": 90}, {"severity": "low", "duration": 180}]
send_slack_message	Whether to send Slack notifications (default: true)	no	true
include_unmonitored_severities	Whether to check and report severities not in sla_config but present in Dependabot alerts (default: false)	no	false
show_breached	Whether to show breached vulnerabilities in the message (default: true)	no	true
show_approaching	Whether to show approaching SLA vulnerabilities in the message (default: true)	no	true
suppress_success_notification	Whether to suppress success notifications when no alerts are found (default: false). When true, no Slack message is sent when no alerts exist.	no	false
log_full_report	Whether to always log the full consolidated report to GitHub Actions logs (default: true).	no	true

no outputs