oss-review-toolkit/Forgejo Action for ORT

A Forgejo Action workflow to run ORT.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Maintainedlast commit Dec 7, 2025
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: oss-review-toolkit/ort-ci-forgejo-action@fde3a6b246d8e6fe49fdaf90c20d877493eb0edb # v1.0.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
vcs-type	Type of version control system. Accepted values are 'git', 'git-repo', 'mercurial' or 'subversion'.	no	git
vcs-url	Repository or clone URL of project to scan.	no	""
vcs-revision	SHA1 or tag to scan (do not use branch names as they can move). If vcs-type is 'git-repo', SHA1 must be unabbreviated. Tag names must be prefixed with 'refs/tags/'.	no	""
vcs-path	Leave this field empty unless one of the following special cases applies: 1) project vcs-type is git-repo - specify path to repo manifest file (e.g. sdk.xml, note vcs-url must point to a manifest repository) 2) you require sparse checkout - specify repository sub-path to download and scan (e.g. projects/gradle/, note sparse checkout is possible only for vcs-type git, mercurial or subversion)	—	""
advisors	Comma-separated list of security vulnerability advisors to use.	no	OSV
allow-dynamic-versions	Set to 'true' only if dynamic dependency versions are allowed (note version ranges specified for dependencies may cause unstable results). This field applies only to package managers that support lock files, e.g. NPM.	no	false
db-url	URL of the PostgreSQL database used for caching scan-results and storing file archives.	no	""
db-username	Username for the PostgreSQL database used for caching scan-results and storing file archives.	no	""
db-password	Password for the PostgreSQL database used for caching scan-results and storing file archives.	no	""
dist-archive-url	The ORT distribution archive to use. If empty, then github.com/oss-review-toolkit/ort/releases/download/72.0.0/ort-72.0.0.tgz is used.	no	""
docker-cli-args	List of arguments to pass to Docker CLI.	no	""
fail-on	Comma-separated list of ORT results that if exceeding their severity threshold will fail the action. Accepted values are '', 'issues', 'violations' or 'issues,violations'. If empty, then exceeding severity threshold will not fail the action.	no	""
http-file-server-url	URL of the HTTP file server used for caching scan-results and storing file archives.	no	""
http-file-server-username	Username for HTTP file server used for caching scan-results and storing file archives.	no	""
http-file-server-password	Password for HTTP file server used for caching scan-results and storing file archives.	no	""
http-file-server-token	API token for HTTP file server used for caching scan-results and storing file archives.	no	""
image	URL for ORT Docker image to use.	no	ghcr.io/oss-review-toolkit/ort:latest
log-level	Set value to 'debug' to see additional debug output to help tracking down errors.	no	warn
mode	Run the action using Docker-in-Docker (dnd) with the specified ORT Docker image in 'image', or natively using the ORT distribution archive (da). Accepted values: 'dnd', 'docker-in-docker', 'da', or 'dist-archive'.	—	da
ort-cli-args	List of arguments to pass to ORT CLI, applies to all commands.	no	-P ort.forceOverwrite=true --stacktrace
ort-cli-analyze-args	List of arguments to pass to ORT Analyzer CLI.	no	""
ort-cli-scan-args	List of arguments to pass to ORT Scanner CLI.	no	""
ort-cli-evaluate-args	List of arguments to pass to ORT Evaluator CLI.	no	""
ort-cli-advise-args	List of arguments to pass to ORT Advisor CLI.	no	""
ort-cli-report-args	List of arguments to pass to ORT Reporter CLI.	no	-O CycloneDX=output.file.formats=json,xml -O SpdxDocument=output.file.formats=json,yaml
ort-config-path	Path to ORT configuration directory within the user home directory.	no	""
ort-home-path	Path to ORT 'home' or 'data' directory within the user home directory.	no	.ort
ort-config-repository	URL to ORT configuration repository to use.	no	https://github.com/oss-review-toolkit/ort-config.git
ort-config-revision	The Git revision or branch of the ORT configuration repository to use.	no	main
ort-yml-path	Path to file containing the repository configuration. If set, the '.ort.yml' file from the repository is ignored.	no	""
orth-dist-archive-url	The ORT helper distribution archive to use. If empty, then github.com/oss-review-toolkit/ort/releases/download/72.0.0/orth-72.0.0.tgz is used.	no	""
project-path	Path within $FORGEJO_WORKSPACE to be analyzed/scanned with ORT. If empty, $FORGEJO_WORKSPACE directory is scanned.	no	${{ forgejo.workspace }}
report-formats	Comma-separated list of ORT reporters to run.	no	CycloneDx,SpdxDocument,WebApp
run	Comma-separated list of optional workflow steps to run.	no	init, setup-python, setup-python-setuptools, setup-python-inspector, setup-java, setup-ort, cache-dependencies, config-git-use-https, labels, analyzer, evaluator, advisor, reporter, upload-results
sw-name	Name of project, product or component to be scanned. By default the name of the repository is used as shown in its clone URL.	no	""
sw-version	Project version number or release name (use the version from package metadata, not VCS revision). By default, the Git short SHA is used.	no	""

Outputs

name	description
advisor-exit-code	The exit code of the ORT Advisor CLI command.
dist-archive-url	The ORT distribution archive used.
evaluator-exit-code	The exit code of the ORT Evaluator CLI command.
ort-config-path	The path to the ORT configuration directory that was used.
ort-config-vcs-revision	The Git revision or branch of the ORT configuration repository that was used.
ort-config-vcs-url	URL to ORT configuration repository that was used.
ort-cli-advise-args	Arguments passed to the ORT Advisor.
ort-cli-analyze-args	Arguments passed to the ORT Analyzer.
ort-cli-evaluate-args	Arguments passed to the ORT Evaluator.
ort-cli-report-args	Arguments passed to the ORT Reporter.
ort-cli-scan-args	Arguments passed to the ORT Scanner.
ort-version	The version of the software analyzed with ORT.
orth-dist-archive-url	The ORT helper distribution archive used.
results-advisor-path	Path to the advisor result file.
results-analyzer-path	Path to the advisor result file.
results-evaluator-path	Path to the evaluator result file.
results-evaluated-model-path	Path to the evaluated model result file.
results-path	Path to the result directory.
results-report-html-path	Path to the static HTML report file.
results-report-web-app-path	Path to the Web App report file.
results-sbom-cyclonedx-xml-path	Path to the CycloneDX XML SBoM file.
results-sbom-cyclonedx-json-path	Path to the CycloneDX JSON SBoM file.
results-sbom-spdx-json-path	Path to the SPDX JSON SBoM file.
results-sbom-spdx-yml-path	Path to the SPDX YML SBoM file.
results-scanner-path	Path to the scanner result file.
sw-name	The name of the software analyzed with ORT.
sw-name-safe	The name of the software analyzed with ORT converted to contain only A-Z, a-z, 0-9 and hyphens.
sw-version	The version of the software analyzed with ORT.