oss-review-toolkit/GitHub Action for ORT

A GitHub Action workflow to run ORT.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 27, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: oss-review-toolkit/ort-ci-github-action@086d928d24ef1653dc0777296b312fda5faaaf52 # v1.2.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
vcs-type	Type of version control system. Accepted values are 'git', 'git-repo', 'mercurial' or 'subversion'.	no	git
vcs-url	Repository or clone URL of project to scan.	no	""
vcs-revision	SHA1 or tag to scan (do not use branch names as they can move). If vcs-type is 'git-repo', SHA1 must be unabbreviated. Tag names must be prefixed with 'refs/tags/'.	no	""
vcs-path	Leave this field empty unless one of the following special cases applies: 1) project vcs-type is git-repo - specify path to repo manifest file (e.g. sdk.xml, note vcs-url must point to a manifest repository) 2) you require sparse checkout - specify repository sub-path to download and scan (e.g. projects/gradle/, note sparse checkout is possible only for vcs-type git, mercurial or subversion)	—	""
advisors	Comma-separated list of security vulnerability advisors to use.	no	OSV
allow-dynamic-versions	Set to 'true' only if dynamic dependency versions are allowed (note version ranges specified for dependencies may cause unstable results). This field applies only to package managers that support lock files, e.g. NPM.	no	false
db-url	URL of the PostgreSQL database used for caching scan-results and storing file archives.	no	""
db-username	Username for the PostgreSQL database used for caching scan-results and storing file archives.	no	""
db-password	Password for the PostgreSQL database used for caching scan-results and storing file archives.	no	""
docker-cli-args	List of arguments to pass to Docker CLI.	no	""
fail-on	Comma-separated list of ORT results that if exceeding their severity threshold will fail the action. Accepted values are '', 'issues', 'violations' or 'issues,violations'. If empty, then exceeding severity threshold will not fail the action.	no	""
http-file-server-url	URL of the HTTP file server used for caching scan-results and storing file archives.	no	""
http-file-server-username	Username for HTTP file server used for caching scan-results and storing file archives.	no	""
http-file-server-password	Password for HTTP file server used for caching scan-results and storing file archives.	no	""
http-file-server-token	API token for HTTP file server used for caching scan-results and storing file archives.	no	""
image	URL for ORT Docker image to use.	no	ghcr.io/oss-review-toolkit/ort:latest
log-level	Set value to 'debug' to see additional debug output to help tracking down errors.	no	warn
ort-cli-args	List of arguments to pass to ORT CLI, applies to all commands.	no	-P ort.forceOverwrite=true --stacktrace
ort-cli-analyze-args	List of arguments to pass to ORT Analyzer CLI.	no	""
ort-cli-scan-args	List of arguments to pass to ORT Scanner CLI.	no	""
ort-cli-evaluate-args	List of arguments to pass to ORT Evaluator CLI.	no	""
ort-cli-advise-args	List of arguments to pass to ORT Advisor CLI.	no	""
ort-cli-report-args	List of arguments to pass to ORT Reporter CLI.	no	-O CycloneDX=output.file.formats=json,xml -O SpdxDocument=output.file.formats=json,yaml
ort-config-path	Path to ORT configuration directory within the user home directory.	no	""
ort-home-path	Path to ORT 'home' or 'data' directory within the user home directory.	no	.ort
ort-config-repository	URL to ORT configuration repository to use.	no	https://github.com/oss-review-toolkit/ort-config.git
ort-config-revision	The Git revision or branch of the ORT configuration repository to use.	no	main
ort-jdk-java-options	Sets ORT JDK_JAVA_OPTIONS env variable used by ort container, defaults to -Xmx5120m.	—	-Xmx5120m
ort-yml-path	Path to file containing the repository configuration. If set, the '.ort.yml' file from the repository is ignored.	no	""
project-path	Path within $GITHUB_WORKSPACE to be analyzed/scanned with ORT. If empty, $GITHUB_WORKSPACE directory is scanned.	no	${{ github.workspace }}
report-formats	Comma-separated list of ORT reporters to run.	no	CycloneDx,SpdxDocument,WebApp
run	Comma-separated list of optional workflow steps to run.	no	cache-dependencies, labels, analyzer, evaluator, advisor, reporter, upload-results
sw-name	Name of project, product or component to be scanned. By default the name of the repository is used as shown in its clone URL.	no	""
sw-version	Project version number or release name (use the version from package metadata, not VCS revision). By default, the Git short SHA is used.	no	""

Outputs

name	description
evaluator-exit-code	The exit code of the evaluator CLI command.
advisor-exit-code	The exit code of the advisor CLI command.
results-path	Path to the result directory.
results-advisor-path	Path to the advisor result file.
results-evaluator-path	Path to the evaluator result file.
results-scanner-path	Path to the scanner result file.
results-html-report-path	Path to the HTML report file.
results-sbom-cyclonedx-xml-path	Path to the CycloneDX XML SBoM file.
results-sbom-cyclonedx-json-path	Path to the CycloneDX JSON SBoM file.
results-sbom-spdx-json-path	Path to the SPDX JSON SBoM file.
results-sbom-spdx-yml-path	Path to the SPDX YML SBoM file.
results-web-app-path	Path to the Web App Report file.