otto-de/SBOM Auditor Action
Audits SBOM for license compliance.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github_token | GitHub token to access the dependency graph API. | yes | ${{ github.token }} |
| fail_hard | If true, the action will fail if license violations are found. | no | false |
| openai_api_key | API key for AI-assisted summary generation. Use with ai_provider input to specify the provider. | no | — |
| ai_provider | AI provider to use for summary generation. Options: openai, azure, bedrock, github. | no | openai |
| azure_endpoint | Azure OpenAI endpoint URL (required when ai_provider is "azure"). | no | — |
| azure_deployment | Azure OpenAI deployment name (required when ai_provider is "azure"). | no | — |
| aws_region | AWS region for Bedrock (required when ai_provider is "bedrock"). | no | — |
| ai_model_name | Specific AI model name to use (optional, provider-specific defaults will be used). | no | — |
| package_policy_path | Path to the optional package policy JSON file. If not provided, helpers/package_policy.json within the action will be used. | no | — |
| policy_path | Path to a custom license policy JSON file. Can contain "policies" (license rules) and/or "packagePolicies" (PURL-based exceptions). By default merged with the built-in policy. | no | — |
| policy_mode | How to handle custom policies: "merge" (default) combines with built-in policies, "replace" uses only the custom policy. | no | merge |
| internal_dependency_pattern | A newline-separated list of regex patterns to identify internal dependencies that should be skipped from the audit. | no | "" |
| enable_cache | Enable caching for SBOM enrichment to speed up subsequent runs. | no | true |
| cache_ttl_hours | Cache time-to-live in hours for package data (default: 168 = 7 days). | no | 168 |
| debug | Enable debug logging for detailed troubleshooting output. | no | false |
Outputs
| name | description |
|---|---|
| audit_exit_code | The exit code of the license audit. 0 if successful, non-zero otherwise. |
| license-audit-report | Path to the license audit report in markdown format. |
| sbom_enriched | Path to the enriched SBOM file. |
| licenses_md | Path to the collected license texts. |